Critical Remote Code Execution Vulnerability Discovered in GitLab AI Gateway

GitLab has issued an urgent security advisory regarding a critical vulnerability discovered in its AI Gateway, a pivotal component that bridges GitLab instances with various artificial intelligence models. The flaw, identified as CVE-2026-90970, carries a nearly maximum CVSS severity score of 9.9 out of 10, signaling a profound risk to organizations that maintain their own self-hosted AI Gateway environments.

According to the official disclosure released on October 2, 2026, the vulnerability could allow a logged-in user possessing Duo Agent Platform access to execute arbitrary commands on the gateway server. Under specific conditions, an attacker could bypass established security boundaries to gain unauthorized control over the infrastructure, potentially leading to a full system compromise.

The AI Gateway serves as a critical nexus in the GitLab ecosystem, particularly for organizations leveraging GitLab Duo and other AI-powered features. While GitLab manages the gateway for its cloud-based customers, many enterprises choose to host the gateway themselves to ensure that sensitive AI request and response data remains within their own controlled environments. It is these self-managed deployments that are currently at risk and require immediate administrative intervention.

Understanding the Vulnerability and Its Impact

The technical core of the vulnerability lies within the "custom flow" mechanism of the Duo Agent Platform. Custom flows are designed to allow users to create sophisticated, AI-driven workflows that automate complex, multi-step tasks. These flows rely on prompt templates to guide the interaction between the user and the underlying large language models.

GitLab’s advisory indicates that the flaw is rooted in how these prompt templates are processed. Specifically, an attacker could craft a specialized flow configuration to "escape" the prompt template sandbox. In security terms, a sandbox is intended to isolate processes and prevent them from interacting with the host operating system or other sensitive resources. By breaking out of this restricted environment, the attacker transitions from merely interacting with an AI model to executing code directly on the server hosting the AI Gateway.

The vulnerability is classified under the Common Weakness Enumeration as CWE-1336, which refers to improper neutralization of directives in a template engine. This class of weakness is particularly dangerous because it allows an attacker to inject malicious code into a template that the system then executes with its own privileges.

The implications of arbitrary command execution on an AI Gateway are significant. The gateway is not a siloed entity; it is a highly connected service. It holds sensitive signing keys for JSON Web Tokens (JWT), which are used to authenticate and authorize communications across the GitLab ecosystem. Furthermore, the gateway maintains active connections to the primary GitLab instance and the external AI model providers. A compromise of the gateway could provide a lateral movement point for attackers to target the broader corporate network or intercept proprietary data being sent to and from AI models.

Scope of Affected Versions and Necessary Actions

The vulnerability affects a broad range of AI Gateway versions, specifically those starting from version 18.1.6. GitLab has identified that all releases within the 19.1 line and earlier versions back to 18.1.6 are susceptible to the exploit. The company has released three specific patched versions to address the issue: 19.2.4, 19.3.2, and 19.4.1.

For organizations running their own AI Gateway, the update process depends on how the service was initially deployed. Most self-hosted gateways are managed as Docker images or via Helm charts for Kubernetes environments. Administrators utilizing Docker must stop their current containers, remove them, and pull the updated image tags, such as the "self-hosted-v19.4.1-ee" tag. Those using Helm must update the image settings within their charts to point to the new, secure versions.

It is important to note that GitLab’s maintenance policy generally covers the three most recent minor versions of the software. As of the disclosure date, these are versions 19.4, 19.3, and 19.2. The fact that fixes were released for these specific lines aligns with this policy, but it also leaves questions for organizations running older, out-of-maintenance versions. GitLab’s installation documentation typically recommends that the AI Gateway version matches the minor version of the GitLab instance. If an organization is running a version older than 19.2, they may need to perform a more comprehensive upgrade of their entire GitLab environment to ensure compatibility with the patched gateway.

GitLab has confirmed that it has already updated the AI Gateways it manages for GitLab.com and GitLab Dedicated customers. Therefore, organizations using these managed services do not need to take any action. The burden of mitigation falls entirely on those who have opted for the self-hosted gateway model to maintain data sovereignty.

Assessment of Current Risk and Historical Context

Despite the critical severity of the flaw, there are currently no reports of CVE-2026-90970 being exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reviewed the vulnerability upon its disclosure and, as of October 2, categorized the exploitation status as "none." This assessment suggests that while the potential for damage is high, the security community has not yet observed active attacks or the public release of a functional proof-of-concept (PoC) exploit.

However, the high CVSS score often serves as a catalyst for threat actors to begin reverse-engineering the patch to develop their own exploits. The requirement for the attacker to be a logged-in user with Duo Agent Platform access provides some level of mitigation, as it prevents unauthenticated attackers on the open internet from reaching the flaw. Nevertheless, in large enterprise environments where many developers or automated systems may have such access, the internal threat surface remains substantial.

This incident is not the first time the GitLab AI Gateway has faced a critical security challenge. In February 2026, GitLab addressed a similar vulnerability, CVE-2026-1868, which also received a 9.9 CVSS score. That previous flaw similarly involved crafted flow definitions and could lead to denial of service or remote code execution. Both vulnerabilities share the same CWE-1336 classification, pointing to a recurring challenge in securing the template engines used for AI prompt orchestration.

The recurring nature of these flaws highlights the inherent difficulty in sandboxing AI-related workflows. As AI becomes more deeply integrated into the software development lifecycle (SDLC), the tools that manage these interactions become high-value targets. The AI Gateway, by design, handles the "prompts" that define how an AI assists a developer. If those prompts can be manipulated to interact with the underlying system shell, the security of the entire CI/CD pipeline is put at risk.

Security Recommendations and Best Practices

GitLab has been proactive in its communication, reportedly reaching out to customers known to be using self-hosted gateways before the public advisory was published. This "heads-up" approach is part of a broader trend in the industry to give administrators a lead time to patch critical infrastructure before the details are made public.

At this time, there are no known workarounds for the vulnerability. Organizations that cannot immediately update their AI Gateway are left with few options other than temporarily disabling the AI features or restricting access to the Duo Agent Platform to a minimal number of highly trusted users. Given the severity of the RCE risk, GitLab strongly recommends that all affected customers prioritize the update.

Furthermore, the advisory does not provide a specific method for administrators to audit their systems for signs of past exploitation. In the absence of such guidance, security teams are encouraged to review their gateway logs for unusual process executions or unexpected network outbound connections, which are often indicators of an RCE event.

The discovery of CVE-2026-90970 was credited to a security researcher known as "invisiblemeerkat," who reported the issue through GitLab’s bug bounty program on the HackerOne platform. Such programs continue to be a vital component of the security landscape, allowing vendors to identify and remediate "zero-day" level threats before they can be weaponized by malicious actors.

As organizations continue to adopt AI-driven development tools, this incident serves as a reminder that the infrastructure supporting these tools must be managed with the same rigor as any other critical enterprise service. The AI Gateway is a powerful enabler for developer productivity, but its role as a bridge between internal codebases and external AI models makes its security paramount. Administrators are urged to verify their gateway versions immediately and apply the necessary patches to protect their environments from potential exploitation.