GitLab has patched a critical vulnerability in its AI Gateway that could let an authenticated user with Duo Agent Platform access run arbitrary commands on self-hosted gateway instances, the company said in a security advisory published October 2, 2026. The flaw was independently reported by The Hacker News the same day.
What Was Found
Tracked as CVE-2026-90970 and rated critical with a CVSS score of 9.9, the vulnerability is an improper neutralization issue in GitLab AI Gateway’s custom flow prompt template handling, classified under CWE-1336. According to GitLab’s advisory, a logged-in user with Duo Agent Platform access can craft flow configurations that escape the prompt template sandbox, allowing arbitrary command execution on the gateway. Researcher “invisiblemeerkat” is credited with responsibly disclosing the issue.
Who Is Affected
Only organizations running GitLab Self-Hosted AI Gateway are affected; GitLab.com-hosted customers do not need to take action. The AI Gateway connects GitLab instances to AI models and, per GitLab, can hold sensitive JWT signing keys, making a compromised gateway a potential pivot point into connected AI infrastructure.
Mitigation
GitLab fixed the flaw in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 and is urging all Self-Managed customers with Self-Hosted AI Gateway installations to upgrade immediately. The company said it conducted targeted outreach to affected customers ahead of the public release post.
This is the second critical, CVSS-9.9-rated template-injection flaw disclosed in GitLab’s AI Gateway this year; a similar issue, CVE-2026-1868, was patched in February. GitLab’s advisory for the new flaw does not reference the earlier one. More AI infrastructure security developments are tracked in the SectechMedia Technology News archive.