GitLab addresses critical RCE vulnerability in AI Gateway
GitLab issued an urgent security advisory on October 2, 2026, warning customers about a critical remote code execution flaw in its AI Gateway service. The vulnerability, tracked as CVE-2026-90970, could allow attackers with basic privileges and Duo Agent Platform access to execute arbitrary commands on unpatched self-hosted instances.
Understanding the AI Gateway service and its exposure
AI Gateway is a core component that enables access to GitLab Duo’s AI-native features. While GitLab operates a cloud-based version used by GitLab.com, GitLab Self-Managed, and GitLab Dedicated customers, organizations can also deploy their own self-hosted AI Gateway instances through GitLab Duo Self-Hosted. It is these self-hosted deployments that are affected by the vulnerability.
Details of CVE-2026-90970: improper neutralization leading to command execution
According to GitLab’s advisory, the flaw stems from an improper neutralization weakness in the prompt template sandbox. Under specific conditions, an authenticated user with access to the Duo Agent Platform could craft a malicious flow configuration to escape the sandbox, thereby achieving arbitrary command execution on the AI Gateway service.
"GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway,"
the company stated in its Friday advisory.
Patched versions and remediation guidance
To address CVE-2026-90970, GitLab released the following updated versions for self-hosted AI Gateway deployments:
- 19.2.4
- 19.3.2
- 19.4.1
GitLab emphasized that customers using the company-hosted AI Gateway service are already protected and do not need to take any action. However, all GitLab Self-Managed customers running self-hosted AI Gateway instances must upgrade immediately to one of the patched versions.
"These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately,"
the advisory added.
GitLab confirmed it had conducted targeted outreach to affected customers prior to the public release, urging them to apply the updates as soon as possible.
Context: recent GitLab vulnerabilities and exploitation trends
This disclosure follows another critical patch released the previous month for a maximum severity path traversal vulnerability, CVE-2026-85706, affecting GitLab Community Edition and Enterprise Edition. That flaw allowed unauthenticated attackers to read sensitive data such as credentials and secrets from vulnerable servers.
Shortly after GitLab’s patch, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, issuing an emergency directive requiring federal agencies to secure their systems within three days under Binding Operational Directive (BOD) 26-04.
Since November 2021, CISA has identified five GitLab vulnerabilities that were exploited in the wild, including one used by ransomware groups in active attacks.
GitLab’s widespread enterprise adoption
GitLab’s DevSecOps platform serves over 30 million registered users and is adopted by more than half of the Fortune 100 companies. Notable enterprise users include Nvidia, Lockheed Martin, T-Mobile, Goldman Sachs, Airbus, and UBS, underscoring the broad impact of timely vulnerability remediation across critical infrastructure and industry sectors.
Source: BleepingComputer