Git Lab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

Summary: GitLab disclosed CVE-2026-90970 on October 2, a critical 9.9-out-of-10 flaw in its AI Gateway that lets a logged-in user with Duo Agent Platform access escape the prompt template sandbox via a specially crafted flow configuration and potentially run arbitrary commands on the gateway. It is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1, and only organizations hosting their own gateway need to act, since GitLab has already patched its hosted service.
What you should know: A self-hosted gateway holds the JWT signing keys GitLab's install guide says must be treated as sensitive credentials, and it connects both to your GitLab instance and to your AI model providers. No workaround is listed, no fixed version exists below 19.2.4, and the advisory gives no way to check whether a gateway was attacked before it was updated.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-1868 CVE-2026-90970
Related: Git Lab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026