Critical GitLab AI Gateway Flaw: What Administrators Need to Do Now

GitLab AI Gateway vulnerability illustration

GitLab has pushed an urgent set of security updates after disclosing a critical vulnerability in its AI Gateway that could allow authenticated users to run arbitrary commands on the gateway. Tracked as CVE-2026-90970 and rated CVSS 9.9, the flaw affects self-hosted AI Gateway deployments that support GitLab Duo AI features. While GitLab’s hosted gateways have already been patched, organizations running their own gateways must act immediately to mitigate a high-impact remote code execution risk.

What happened

GitLab discovered that custom flow prompt templates in the AI Gateway could be handled improperly. Under certain conditions, an authenticated actor with Duo Agent Platform access can submit a specially crafted flow configuration that escapes the template sandbox. That sandbox escape can cross the intended processing boundary and reach command execution on the AI Gateway itself — a far more serious outcome than simply influencing an AI response. The issue was responsibly reported by researcher invisiblemeerkat; GitLab’s advisory does not provide an exploit payload, nor does it report evidence of active exploitation.

How the vulnerability works

At a high level, the problem is a template-sandbox escape. Template engines use sandboxes to constrain what template input can do during processing; a successful escape lets crafted input run beyond those constraints. In this case, the attacker needs a valid account with Duo Agent Platform privileges to submit a malicious flow configuration. GitLab’s published CVSS vector describes a network-accessible attack with low complexity, low privileges required, and no user interaction — but crucially it is not anonymous: the attacker must be authenticated.

Who is affected

The vulnerability affects certain AI Gateway releases. GitLab fixed the issue in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1. Affected release ranges include versions beginning at 18.1.6 up to the fixed releases in the 19.x branches. Importantly, the AI Gateway component’s version is the relevant target for inspection — administrators should verify the gateway deployment itself rather than relying solely on the main GitLab instance version. Customers using GitLab.com, GitLab Dedicated, or Self-Managed instances that rely on GitLab-hosted AI Gateways are already protected and do not need to take action for this issue.

Immediate steps to take

Identify your deployment type. Confirm whether your environment uses a self-hosted AI Gateway. If you use GitLab-hosted gateways, you’re already covered. If you operate your own gateway, proceed without delay.
Upgrade the AI Gateway. Install the patched images: 19.2.4, 19.3.2, or 19.4.1 depending on your branch. Follow GitLab’s installation and upgrade documentation precisely.
Docker instructions. Stop and remove the existing container, then pull and run the new image with the correct environment variables. Verify the image digest and run health checks after deploying the patched image.
Kubernetes/Helm instructions. Ensure image pull policies and digests are used so that updated images are actually pulled instead of relying on cached images. Redeploy the gateway pods with the patched image and validate their health.
Limit exposure. While patching is the priority, temporarily restrict unnecessary outbound gateway traffic and tighten network controls around the gateway to reduce the attack surface.

Hardening and monitoring recommendations

To reduce the risk of exploitation and improve detection, administrators should combine immediate patching with longer-term operational controls and monitoring.

Verify permissions: Audit which accounts have Duo Agent Platform access and remove or reduce privileges where possible. An authenticated attacker with that specific access is required to exploit this flaw.
Logging and alerts: Ensure gateway logs are forwarded to your SOC and watch for unusual flow configuration submissions or template processing errors. Create alerts for any unexpected template or flow uploads.
Integrity checks: Use image digests and verify signatures or digests in your deployment pipeline so you know exactly which image version is running.
Network segmentation: Isolate the gateway from less trusted parts of your network and enforce strict egress controls to limit what a compromised gateway could reach.
Incident readiness: Because the vulnerability could allow command execution, prepare an incident response playbook focused on quickly isolating the gateway, collecting forensic artifacts, and rolling back to known-good images if needed.

Why this matters

This vulnerability underscores a broader risk area: treating AI infrastructure as ordinary application components can hide unique attack surfaces. Template engines and custom flow processors are powerful but can be dangerous when they process user-supplied configurations. A sandbox escape that leads to RCE can compromise the service that processes AI requests, exposing secrets, pivoting further into an environment, or disrupting availability. The high CVSS score reflects the potential impact across confidentiality, integrity, and availability, even though exploitation requires an authenticated user.

Conclusion

If you run a self-hosted GitLab AI Gateway, treat this as a high-priority patching task: identify gateways, apply one of the fixed releases, verify image digests, and run health checks. Combine immediate remediation with longer-term hardening: audit Duo Agent access, tighten network controls, and instrument monitoring so suspicious flows are detected quickly. Even without public exploit code, the severity and nature of CVE-2026-90970 make swift action essential.