Category: Security | Reading time: 5 min
The Patch Release
On 2 October 2026, GitLab published a critical patch release for the GitLab AI Gateway: versions 19.2.4, 19.3.2, and 19.4.1. The fix addresses CVE-2026-90970, scored CVSS 9.9 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). GitLab credited HackerOne researcher invisiblemeerkat for responsible disclosure.
According to GitLab’s advisory, the issue is improper neutralization in custom flow prompt templates (CWE-1336). Under certain conditions, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway host.
Impacted AI Gateway versions are all releases from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. GitLab says a fix is already deployed for GitLab-hosted AI Gateways. Customers on GitLab.com, GitLab Dedicated, or Self-Managed instances that use a GitLab-hosted gateway do not need to act. Self-Hosted AI Gateway operators do: GitLab conducted targeted outreach and recommends immediate upgrade.
Where the Gateway Sits
The AI Gateway is the middle layer between GitLab Duo features—code suggestions, chat, explanation, and agentic workflows—and the underlying models. It receives requests from GitLab, prepares prompts, and talks to the LLMs. Organizations that want AI traffic to stay inside their own boundary can run the gateway on their infrastructure alongside GitLab and chosen models.
That placement matters for impact. Self-hosted deployments use signing and validation keys for JSON Web Tokens, passed to the gateway as environment variables. Command execution on the gateway is not “only a chat sandbox problem.” It is foothold risk on infrastructure that handles AI requests and authentication material. Exact blast radius depends on how the gateway is deployed and what else it can reach.
GitLab’s 2 October advisory does not claim exploitation in the wild and does not publish a proof of concept or the precise flow configuration required. Security Affairs and OpenCVE summaries match the official description: authenticated Duo Agent Platform access, crafted flow configuration, template sandbox escape, arbitrary command execution on the gateway.
Sandbox Escape Is an Authorization Failure
For enterprise buyers evaluating Duo Agent Platform or any agent stack that lets users define flows and templates, the pattern is familiar. A sandbox exists. A privileged authenticated user can still craft input that the template engine executes outside the intended boundary. Network authentication is required; unauthenticated internet access is not. Privilege is “low” in CVSS terms—any Duo Agent Platform user who can modify flow configuration—while scope is changed because compromise of the gateway affects resources beyond the user’s own session.
That combination is why the score is 9.9. Regulated teams that self-host the gateway for data residency or model-control reasons are exactly the population GitLab told to patch first.
What Deployers Should Take From It
If you run a GitLab Self-Hosted AI Gateway on an affected version, upgrade to 19.2.4, 19.3.2, or 19.4.1 now. Review existing flow configurations for unexpected template syntax. Restrict Duo Agent Platform flow-edit access until the patch is confirmed.
The Cyphrex-relevant takeaway is about evidence, not brand. Prompt sandboxes and agent platforms are becoming production infrastructure. When a crafted flow can leave the sandbox and run commands on the gateway, “the model stayed in policy” is not the record an examiner needs. Who was authorized to edit flows. What template and tool scope that user had. Whether the gateway executed a step that policy said was blocked. Whether that record is durable and independently verifiable after the fact.
Patching closes this CVE. Write-time identity, authorization, and enforcement records are what turn the next sandbox escape into something a security team can prove rather than reconstruct from vendor notes.
Source: GitLab AI Gateway Critical Patch Release · CVE Record — CVE-2026-90970 · Security Affairs