GitLab has recently unveiled urgent security updates addressing a significant flaw in its Self-Hosted AI Gateway, a component pivotal for numerous organizations harnessing AI-driven development workflows. This vulnerability, identified as CVE-2026-90970, poses a grave risk as it may enable authenticated attackers to execute arbitrary commands on affected AI Gateway deployments, which could have catastrophic consequences for data security and operational integrity.
The flaw has been assigned a severe CVSS (Common Vulnerability Scoring System) score of 9.9 out of 10, signaling the potential for severe fallout if exploited. In response to this critical issue, GitLab has taken decisive action by releasing three updated versions of the AI Gateway: 19.2.4, 19.3.2, and 19.4.1. These updates are designed specifically to mitigate the vulnerabilities associated with the AI Gateway component, which is integral to the GitLab Duo platform’s self-hosted capabilities.
A deeper dive into the vulnerability reveals that it arises from what is termed an improper neutralization flaw in the custom flow prompt template functionality within GitLab’s AI Gateway. Under particular circumstances, authenticated users with access to the Duo Agent Platform can create or submit specially crafted configuration flows that manage to escape the confines of the intended prompt-template sandbox. The ramifications of this flaw are considerable; successful exploitation could permit an attacker to execute arbitrary commands on the host or the environment where the AI Gateway operates.
This level of access is especially alarming as it provides attackers with the potential to reach sensitive development data. From manipulating AI workflow configurations to stealing service credentials and even moving laterally within connected infrastructure, the opportunities for damaging breaches are plentiful. Additionally, this vulnerability could disrupt AI-enhanced development operations, significantly impacting productivity and overall business functionality.
For professionals in cybersecurity, the CVSS 3.1 vector for CVE-2026-90970 is particularly revealing. It indicates that this flaw can be exploited remotely with a low level of attack complexity. Notably, while the attacker does not need user interaction to carry out the exploit, they must possess low-privileged authenticated access to the affected Duo Agent Platform functionality to initiate their attack.
Given the severity of the situation, GitLab has made it a priority to communicate promptly with potentially affected self-hosted AI Gateway customers prior to publicly disclosing the security advisory. The vulnerability impacts installations of the GitLab AI Gateway starting from version 18.1.6, affecting a range of versions up until the newly released patches. Specifically, those utilizing GitLab AI Gateway versions from 18.x through versions prior to 19.2.4, 19.3 through versions prior to 19.3.2, and 19.4 through versions prior to 19.4.1 are at risk. Importantly, customers using GitLab-hosted AI Gateway environments are not impacted by this vulnerability, as GitLab has already rolled out protective measures for these users.
In light of this incident, organizations utilizing self-hosted AI Gateway are strongly urged to prioritize upgrading to one of the fixed versions: 19.2.4, 19.3.2, or 19.4.1, based on their current supported release track. Security teams are also encouraged to conduct a thorough review of Duo Agent Platform access assignments. Inspecting custom flow configurations for any unexpected or unauthorized alterations, alongside monitoring AI Gateway logs for any signs of suspicious command execution activity, is essential in maintaining a secure operational environment.
While the recommendation is to implement the necessary updates, organizations may also consider restricting Duo Agent Platform permissions as interim mitigation while the patching process is underway. However, it is crucial to note that these access controls should not serve as a substitute for applying the security updates.
Ultimately, GitLab’s response to this vulnerability illustrates the growing necessity for stringent security measures within AI workflow platforms. The company’s fix aims to safeguard prompt and template components from potential exploitation, thereby ensuring a more secure development environment for all users. As this landscape continues to evolve, vigilance and swift action in addressing such vulnerabilities will be paramount for organizations navigating the world of AI-assisted development.