GitLab shipped an emergency patch release on Friday for a critical remote code execution flaw in the GitLab AI Gateway, the standalone service that backs the company’s Duo AI features. The bug, tracked as CVE-2026-90970, scores 9.9 out of 10 on the CVSS scale. If your AI Gateway runs in your own infrastructure, you need to pull a new container image. If it runs on GitLab’s side, the fix has already been deployed for you.
What the flaw actually is
CVE-2026-90970 is a template injection bug, classified as CWE-1336: improper neutralization of special elements used in a template engine. An authenticated user with access to the Duo Agent Platform could escape the prompt template sandbox through a specially crafted flow configuration, and from there execute arbitrary commands on the gateway host.
The CVSS vector tells the story in shorthand: network reachable, low attack complexity, low privileges required, no user interaction, and a changed scope that spills high impact across confidentiality, integrity, and availability. In plain terms, a regular logged-in user with the right feature access could turn the gateway into their own machine.
GitLab credits HackerOne researcher invisiblemeerkat with the disclosure. The affected versions run from 18.1.6 up to (but not including) 19.2.4, from 19.3 before 19.3.2, and 19.4 before 19.4.1. The fixes are 19.2.4, 19.3.2, and 19.4.1 on their respective release lines.
Who needs to act, and who does not
This is the part that decides whether your Monday starts with a patch or a shrug. GitLab operates a hosted AI Gateway that serves GitLab.com, GitLab Dedicated, and Self-Managed instances configured to use the cloud gateway. Those have already been patched server-side. GitLab’s own documentation describes the split plainly: the gateway is a separate service, and most customers never run it themselves.
Customers on GitLab Duo Self-Hosted do run it themselves, as a model-gateway Docker container with an HTTP service on port 5052 and a gRPC service for the Duo Agent Platform on port 50052. For those deployments, a routine GitLab upgrade does nothing. The fix lives in the gateway image, not the main application release. You stop the container, pull the new self-hosted-vX.Y.*-ee image that matches your GitLab version, and restart with the same environment variables.
GitLab says it did targeted outreach to self-hosted customers before publishing the advisory, which is a sensible touch. It also means the vendor knows exactly how small that exposed population is, and took it seriously enough to contact them individually.
The prompt template sandbox keeps failing
Here is the part worth sitting with. This is the second 9.9-rated template engine flaw in the AI Gateway in under a year. In February 2026, GitLab fixed CVE-2026-1868, also scored 9.9, also CWE-1336, also reachable by a logged-in user through a crafted flow definition.
Two critical bugs in the same class, on the same surface, within twelve months, is not bad luck. It is a design smell. Prompt templates and custom flow configurations are, functionally, user-supplied code executed inside a sandbox. Sandboxes around template engines are notoriously hard to get right because template engines were never built with hostile input in mind. Every additional templating feature widens the escape surface.
The blast radius here is also worse than the average web app RCE. An AI Gateway holds JWT signing keys and credentials for downstream model endpoints. Compromise the gateway and an attacker can sign tokens, redirect model traffic, or harvest API keys for the LLM providers behind it. The AI infrastructure tier is quietly becoming one of the highest-value targets in a dev stack, and most organizations treat it like a black box they do not patch.
Context: GitLab’s security ledger
The AI Gateway bug lands against a rough backdrop. GitLab recently patched CVE-2026-85706, a maximum severity path traversal flaw in Community and Enterprise Edition that let unauthenticated attackers read sensitive data such as credentials and secrets. CISA added it to the Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies. Since November 2021, CISA has tagged five GitLab vulnerabilities as exploited in the wild, including one used by ransomware gangs.
For the new gateway flaw, the immediate signs are calmer. It is not in CISA’s KEV catalog, no public proof of concept has surfaced, and the CVE enrichment lists exploitation as none. BleepingComputer’s report notes GitLab claims more than 30 million registered users and a majority of the Fortune 100, which is exactly the customer base that runs self-hosted AI features without a dedicated person watching that container.
What to do this week
- Check whether your GitLab Self-Managed deployment points at a self-hosted gateway or the GitLab-hosted one. Hosted means you are done.
- If you self-host, upgrade to 19.2.4, 19.3.2, or 19.4.1 on the line that matches your GitLab version. Stop the container, pull the matching self-hosted-vX.Y.*-ee image, restart with the same environment variables.
- Trim who has Duo Agent Platform access. The attack requires an authenticated account with that access, so every extra seat is extra risk.
- If you suspect compromise, look for unexpected child processes or outbound connections from the gateway container, and rotate the JWT and model endpoint credentials it holds.
- Put the AI Gateway on your patch cadence explicitly. Two critical fixes in a year means waiting for the next big GitLab release is not a strategy.
No workaround was published, which fits the nature of the bug: there is no configuration toggle that un-breaks a template engine. The only real fix is the patched image, and the only real defense afterward is limiting who can reach the feature in the first place.