GitLab on Friday, 2nd October 2026, told customers running their own AI Gateway to patch CVE-2026-90970 immediately. The critical flaw lets an authenticated user with Duo Agent Platform access escape a prompt template sandbox and run arbitrary commands.
The Brief
- GitLab shipped AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to close the flaw for self-hosted deployments.
- Customers on GitLab’s own hosted AI Gateway are already protected and don’t need to take any action, the company said.
- The NVD entry lists every gateway release from 18.1.6 up to those fixed builds as affected.
- Attackers need only basic privileges plus Duo Agent Platform access, with no user interaction, according to GitLab’s own severity scoring.
A crafted flow configuration breaks the sandbox
AI Gateway is the service behind GitLab Duo’s AI-native features. GitLab runs a cloud instance that serves GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Customers can also deploy their own gateway on Self-Managed through GitLab Duo Self-Hosted, and those installations are the ones that need the update.
The bug lives in the gateway’s template engine. GitLab’s release post says a specially crafted flow configuration could let a user escape the prompt template sandbox. That escape leads to command execution on the gateway itself. The NVD entry files it under CWE-1336, improper neutralization of special elements used in a template engine.
🚨Critical – GitLab AI Gateway Prompt Template Sandbox Escape RCE (CVE-2026-90970)
— Upwind Security MDR (@UpwindMDR) October 2, 2026
GitLab AI Gateway allows an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command…
GitLab’s vector string, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, describes a network attack with low complexity and a changed scope. Confidentiality, integrity, and availability impact all rate high. NIST hasn’t posted its own NVD assessment yet.
Agent tooling has a history of turning inputs into code execution, as seen in earlier argument injection flaws in AI agents. Here, the input is a flow configuration that a legitimate Duo user is allowed to write.
Self-hosted gateways carry the patching burden
GitLab said it contacted Self-Hosted AI Gateway customers with upgrade guidance before publishing the advisory. Its release post is blunt: “we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately.“
The login requirement separates this bug from GitLab’s previous critical fix. Last month, GitLab patched CVE-2026-85706, a maximum-severity path traversal flaw in Community Edition and Enterprise Edition that let unauthenticated attackers read credentials and secrets. CISA added it to its Known Exploited Vulnerabilities catalog a day later. Federal agencies got three days to secure systems under Binding Operational Directive 26-04.
CISA has flagged five GitLab vulnerabilities as exploited in the wild since November 2021, including one abused by ransomware gangs. GitLab’s DevSecOps platform has over 30 million registered users. Over 50% of Fortune 100 companies use it, among them Nvidia, Lockheed Martin, Airbus, and UBS. That base has already absorbed a June GitLab security update fixing 13 vulnerabilities.
The new flaw’s exposure is narrower, though harder to spot. An attacker needs a real account with Duo Agent Platform access, so a stolen login or a careless insider becomes the way in. Once the sandbox breaks, commands run on infrastructure the customer maintains, outside GitLab’s hosted footprint.
Neither the NVD record nor the GitLab guidance quoted here mentions exploitation. Two questions sit outside that public material: who reported the flaw, and did any self-hosted gateway receive a malicious flow configuration before patching?
What’s Next?
Admins running their own gateway can reduce risk with four checks:
- Compare the running gateway version against the affected ranges in the NVD entry.
- Upgrade the AI Gateway Docker image to a fixed release using GitLab’s upgrade instructions.
- Review which accounts hold Duo Agent Platform access and remove it where nobody needs it.
- Audit recent flow configuration changes for entries the team can’t account for.
GitLab-hosted customers can skip the checklist entirely. For self-hosted shops, the deciding detail is a version string. Any unpatched gateway in the affected range stays open to a Duo user with the right access until an admin swaps the image.
