A CVSS score of 9.9 out of a possible 10 is rare. It’s even rarer for such a rating to hit an AI infrastructure component running in thousands of enterprise environments. That’s exactly what happened on October 2, 2026, when GitLab disclosed CVE-2026-90970: a critical GitLab AI Gateway vulnerability that lets an authenticated user escape an otherwise isolated sandbox and execute arbitrary commands on the server.
For development and security teams running GitLab Self-Managed with the Duo Agent Platform, this isn’t an abstract risk. It’s an urgent call to action.
Table of Contents
Key Takeaways
- CVE-2026-90970 affects the self-hosted GitLab AI Gateway with the Duo Agent Platform enabled, and scores a CVSS of 9.9 (CRITICAL).
- An authenticated user can escape the prompt-template sandbox via a crafted flow configuration and achieve remote command execution.
- Affected versions: 18.1.6 up to (but not including) 19.2.4, 19.3 up to 19.3.2, and 19.4 up to 19.4.1.
- Fixes are available in AI Gateway 19.2.4, 19.3.2, and 19.4.1; GitLab-hosted (SaaS) customers were patched automatically.
- No active exploitation was known at disclosure, but GitLab recommends patching immediately.
What Is CVE-2026-90970? The GitLab AI Gateway Vulnerability in Detail
The GitLab AI Gateway vulnerability CVE-2026-90970 was officially disclosed on October 2, 2026. It affects exclusively self-hosted instances of the AI Gateway, the component that connects GitLab Duo and the Duo Agent Platform to language models. According to the entry in the National Vulnerability Database (nvd.nist.gov/vuln/detail/CVE-2026-90970), the flaw received a CVSS base score of 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
In plain terms: an attacker needs only low privileges (PR:L), no user interaction (UI:N), and no complex attack sequence (AC:L) to gain, remotely (AV:N), full access to the confidentiality, integrity, and availability of the system (C:H/I:H/A:H). The scope-change indicator (S:C) further shows that the impact reaches beyond the directly compromised component.
Technically, the root of the problem lies in how the Duo Agent Platform processes flow configurations. A user with access to the platform can submit a manipulated configuration that bypasses the boundaries of the prompt-template sandbox. The result is remote command execution directly on the AI Gateway server.
What Is a Prompt Sandbox Escape?
Understanding the scope of the GitLab AI Gateway vulnerability requires a look at the underlying concept: the prompt sandbox escape.
AI-powered development platforms like the Duo Agent Platform rely on prompt templates — predefined text blocks into which dynamic user input is inserted before being sent to a language model. To prevent that input from causing harm, it normally runs inside a sandbox: a tightly scoped execution environment that prevents code from the template context from reaching the actual operating system or other services.
A sandbox escape means that protective wall is breached. In CVE-2026-90970, this happens through a specially crafted flow configuration that tricks the sandbox’s validation logic. Instead of the input staying safely contained within prompt processing, it reaches an execution context where system commands are interpreted directly. That’s the difference between a harmless chatbot trick and a full server compromise.
In simple terms: the sandbox is like a glass box meant to safely process user input. This vulnerability allows an attacker to crack that glass and, from the inside, reach the entire building — the AI Gateway server itself.
Why CVSS 9.9 Is So High
A CVSS score of 9.9 is close to the theoretical maximum. Several factors explain why the GitLab AI Gateway vulnerability was rated this severely.
Low barrier to entry. The privileges an attacker needs (PR:L) are low — a regular, authenticated user with access to the Duo Agent Platform is enough. No administrator account is required.
No user interaction needed. The target system doesn’t need to click a crafted file or open a link first. The attack happens directly through the flow configuration.
Full impact across all three protection goals. Confidentiality, integrity, and availability are all rated “High.” An attacker can read data, modify it, and disrupt the service.
Scope change. The attack doesn’t stay confined to the compromised component but can affect adjacent systems — a decisive factor in the high rating.
Combined, this produces an attack profile security researchers rarely see: low attack complexity, low prerequisites, maximum damage. That exact combination justifies the near-perfect score.
Who Is Affected by the GitLab AI Gateway Vulnerability
Not every GitLab instance is at risk. The vulnerability affects exclusively self-hosted / self-managed installations of the AI Gateway where the Duo Agent Platform is actively in use.
| Deployment Model | Affected? | Required Action |
|---|---|---|
| GitLab SaaS (GitLab.com) | No | None, patched automatically |
| Self-Managed without Duo Agent Platform | No | None |
| Self-Managed with Duo Agent Platform | Yes | Patch immediately |
Specifically affected AI Gateway version ranges:
- Version 18.1.6 up to (but not including) 19.2.4
- Version 19.3 up to 19.3.2
- Version 19.4 up to 19.4.1
According to GitLab’s official patch release announcement (docs.gitlab.com/releases/patches), GitLab-hosted (SaaS) customers have already been moved automatically to a secure version. Anyone using GitLab’s cloud offering doesn’t need to take action themselves. The picture is different for anyone running the AI Gateway on their own infrastructure — for example, due to compliance requirements, data-residency rules, or air-gapped environments.
Patch and Immediate Actions for Admins
The most important step is unambiguous: patch, and do it now. GitLab has made the fixed versions 19.2.4, 19.3.2, and 19.4.1 available. Anyone running one of the affected version lines should update to the corresponding fixed release.
DevOps and security teams should take the following steps without delay:
- Check your version. Verify which AI Gateway version is currently deployed. Any instance between 18.1.6 and 19.2.4, between 19.3 and 19.3.2, or between 19.4 and 19.4.1 is vulnerable.
- Apply the patch. Upgrade to 19.2.4, 19.3.2, or 19.4.1 depending on the version line in use, following GitLab’s official patch release page.
- Review access permissions. Since a low-privilege authenticated user is already sufficient, the circle of people with access to the Duo Agent Platform should be reviewed and reduced to what’s necessary.
- Audit flow configurations. Existing and recently submitted flow configurations should be checked for unusual or unauthorized changes.
- Check logs. Review AI Gateway server and application logs for suspicious command executions or unexpected process starts, even though no active exploitation was known at disclosure.
Important: because this component interacts directly with language models and code execution, simply “scheduling an update” isn’t enough. Given the CVSS score of 9.9, this patch should be treated as an emergency measure, comparable to a critical zero-day in a production database.
Bug Bounty Discovery and Current Status
The GitLab AI Gateway vulnerability wasn’t discovered through an incident in the wild — it was reported through GitLab’s HackerOne bug bounty program. The reporting researcher goes by the handle “invisiblemeerkat.” This underscores how important structured bug bounty programs are for the security of complex AI infrastructure, especially for novel attack vectors like sandbox escapes in prompt-processing systems, for which few established testing methods yet exist.
According to GitLab and CISA, no known active exploitation existed as of the disclosure date, October 2, 2026 (“exploitation: none” at disclosure). That’s good news, but it doesn’t change the urgency: critical vulnerabilities with publicly known technical details are, experience shows, actively exploited within days to weeks of disclosure, once attackers analyze the patch diffs and reconstruct a working exploit.
Additional technical analyses, including from the Aviatrix Threat Research Center and a security report from Windows Forum, corroborate GitLab’s and the NVD’s assessment of severity and attack vector.
Risk Assessment and Outlook
The GitLab AI Gateway vulnerability CVE-2026-90970 is a textbook example of how new classes of risk emerge when development platforms equip AI agents with real execution rights. While classic vulnerabilities often trace back to familiar patterns like SQL injection or buffer overflows, this case opens up a new attack surface: the boundary between prompt processing and system execution.
For organizations integrating generative AI features into their development workflows, the takeaway is this: sandbox mechanisms around AI agents must be scrutinized with the same rigor as classic privilege separation in operating systems. A single configuration error in flow processing can, as this case shows, lead directly to a complete server compromise.
Conclusion and Next Steps
With a CVSS score of 9.9, the GitLab AI Gateway vulnerability CVE-2026-90970 ranks among the most severe flaws disclosed in a widely used DevOps platform in 2026. Only self-managed installations with the Duo Agent Platform enabled, in the version ranges 18.1.6 up to 19.2.4, 19.3 up to 19.3.2, and 19.4 up to 19.4.1, are affected.
Recommended actions for any team running a self-hosted AI Gateway:
- Update immediately to version 19.2.4, 19.3.2, or 19.4.1.
- Review and restrict access permissions to the Duo Agent Platform.
- Retroactively check logs and flow configurations for anomalies.
- Keep an eye on GitLab’s patch announcements (docs.gitlab.com/releases/patches) and the NVD entry in case the exploitation status changes.
Even though no active exploitation was known as of October 4, 2026, this vulnerability should be treated with the highest priority. The faster it’s patched, the smaller the window for potential attackers to turn the publicly available technical details into a working exploit.
Other development tools have recently had critical security vulnerabilities too: read our article Next.js September 2026 Security Release: SSRF and Cache Poisoning Fixes Explained.
