A critical GitLab AI Gateway flaw could allow authenticated attackers to execute commands on vulnerable systems. GitLab has released security updates and urged customers running self-hosted installations to apply them immediately.
However, customers using GitLab’s hosted AI Gateway do not need to take action. The company says it has already secured that service.
Self-Hosted Customers Need to Update
GitLab released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1 to address the vulnerability. Customers operating their own gateway should upgrade to an appropriate patched release without delay.
The AI Gateway connects GitLab environments with AI-powered Duo features. GitLab operates a hosted service, while eligible Self-Managed customers can run their own through GitLab Duo Self-Hosted.
Consequently, administrators should establish which gateway their installation uses. Running GitLab Self-Managed alone does not mean a customer operates a self-hosted AI Gateway.
GitLab also contacted self-hosted customers before publishing its advisory to provide advance guidance about the update.
Attack Requires Authentication and Duo Access
The GitLab AI Gateway flaw carries the identifier CVE-2026-90970 and involves improper handling of prompt templates.
According to GitLab, an attacker could submit a specially crafted flow configuration to escape the prompt template sandbox. Under certain conditions, that escape could enable arbitrary command execution on the gateway.
However, exploitation requires an authenticated account with basic privileges and access to the Duo Agent Platform. The reported attack therefore requires more than an unauthenticated connection to an exposed service.
The sandbox normally restricts what prompt templates can do. Bypassing that boundary could allow an attacker to affect the underlying gateway environment.
Earlier GitLab Vulnerability Involved a Separate Risk
Meanwhile, GitLab recently addressed another serious issue affecting its Community and Enterprise editions.
That vulnerability, CVE-2026-85706, involved path traversal and could allow unauthenticated attackers to read sensitive server data, including credentials and secrets.
CISA subsequently added the earlier flaw to its Known Exploited Vulnerabilities catalog. However, that exploitation history concerns the separate path traversal issue.
The supplied information does not establish active exploitation of the new AI Gateway vulnerability. Nevertheless, GitLab classifies the issue as critical and recommends immediate updates for affected self-hosted installations.
0 responses to “GitLab AI Gateway Flaw Prompts Urgent Security Updates”