GitLab AI Gateway 19.4.1 fixes CVE-2026-90970, a 9.9 sandbox escape reachable through a crafted agent flow

GitLab has shipped a critical patch release for the self-hosted version of its AI Gateway, the service that sits between GitLab and the models behind GitLab Duo. The release post opens: "We have released versions 19.2.4, 19.3.2, and 19.4.1 of the GitLab AI Gateway." It contains one fix, for CVE-2026-90970. The CVE record, filed by GitLab as the numbering authority, was published on October 2, 2026.

What the flaw is

GitLab's description, in full:

GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.

GitLab AI Gateway Critical Patch Release

The post titles it "Improper Neutralization issue in custom flow prompt template impacts AI Gateway," and the CVE record classes it as CWE-1336, improper neutralization of special elements in a template engine.

The score is 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Read the vector rather than the number: PR:L means the attacker needs an account, but only an ordinary one with Duo Agent Platform access, not administrator rights. S:C (scope changed) means the damage escapes the component that holds the bug: a template meant to shape a prompt ends up running commands on the host. An AI gateway is also, by design, the place that holds model provider credentials and sees every prompt routed through it. The post does not discuss what an attacker could reach from there; that is our inference from what the service does.

Who has to act

Only operators of GitLab Self-Hosted AI Gateway. Affected versions are "All versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1." The post is explicit about everyone else: "A fix has already been deployed for GitLab-hosted AI Gateways." Customers on GitLab.com, GitLab Dedicated, and Self-Managed instances that use a GitLab-hosted gateway "are protected and do not need to take action."

For self-hosted installs, the instruction is to upgrade "as soon as possible" to one of the three patched versions. GitLab also says it "conducted targeted outreach to Self-Hosted AI Gateway customers prior to this release post with this guidance," so some operators will have been told before the public post went up.

What the post does not say

The release post is thin, and the gaps are worth listing:

• No workaround. None is mentioned. There is no setting to disable custom flows as a stopgap.
• No exploitation statement. The post neither claims nor rules out exploitation in the wild.
• No detection guidance. No indicators of compromise, and no advice on reviewing past flow configurations.
• No image tags. Upgrade steps are deferred to the general self-hosted install documentation.

The CVE record references a GitLab work item, number 628842. The post credits invisiblemeerkat, reporting through HackerOne.

What to do

Upgrade the gateway. Until that is done, the vector itself points at the interim exposure: the set of users who hold Duo Agent Platform access and can define a flow configuration. That list is worth reviewing either way, along with the credentials the gateway holds, if there is any doubt about who had that access while an affected version was running.

Primary sources: GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1, CVE-2026-90970 record (OpenCVE), read 2026-10-13.