Critical Remote Code Execution Vulnerability Discovered in GitLab AI Gateway

GitLab has issued an urgent security advisory regarding a critical vulnerability discovered in its AI Gateway, a pivotal component that bridges GitLab instances with various artificial intelligence models. The flaw, identified as CVE-2026-90970, carries a nearly maximum CVSS severity score of 9.9 out of 10, signaling a profound risk to organizations that maintain their own self-hosted AI Gateway environments.

According to the official disclosure released on October 2, 2026, the vulnerability could allow a logged-in user possessing Duo Agent Platform access to execute arbitrary commands on the gateway server. Under specific conditions, an attacker could bypass established security boundaries to gain unauthorized control over the infrastructure, potentially leading to a full system compromise.

The AI Gateway serves as a critical nexus in the GitLab ecosystem, particularly for organizations leveraging GitLab Duo and other AI-powered features. While GitLab manages the gateway for its cloud-based customers, many enterprises choose to host the gateway themselves to ensure that sensitive AI request and response data remains within their own controlled environments. It is these self-managed deployments that are currently at risk and require immediate administrative intervention.

Understanding the Vulnerability and Its Impact

The technical core of the vulnerability lies within the "custom flow" mechanism of the Duo Agent Platform. Custom flows are designed to allow users to create sophisticated, AI-driven workflows that automate complex, multi-step tasks. These flows rely on prompt templates to guide the interaction between the user and the underlying large language models.

GitLab’s advisory indicates that the flaw is rooted in how these prompt templates are processed. Specifically, an attacker could craft a specialized flow configuration to "escape" the prompt template sandbox. In security terms, a sandbox is intended to isolate processes and prevent them from interacting with the host operating system or other sensitive resources. By breaking out of this restricted environment, the attacker transitions from merely interacting with an AI model to executing code directly on the server hosting the AI Gateway.

The vulnerability is classified under the Common Weakness Enumeration as CWE-1336, which refers to improper neutralization of directives in a template engine. This class of weakness is particularly dangerous because it allows an attacker to inject malicious code into a template that the system then executes with its own privileges.

The implications of arbitrary command execution on an AI Gateway are significant. The gateway is not a siloed entity; it is a highly connected service. It holds sensitive signing keys for JSON Web Tokens (JWT), which are used to authenticate and authorize communications across the GitLab ecosystem. Furthermore, the gateway maintains active connections to the primary GitLab instance and the external AI model providers. A compromise of the gateway could provide a lateral movement point for attackers to target the broader corporate network or intercept proprietary data being sent to and from AI models.