GitLab patches a 9.9 RCE in its self-hosted AI Gateway

On 2026-10-02, GitLab released a critical fix for its AI Gateway and tracked it as CVE-2026-90970, scoring it 9.9 out of 10 (GitLab, 2026-10-02). An authenticated user with Duo Agent Platform access can escape the prompt-template sandbox through a crafted flow configuration and run arbitrary commands on a self-hosted AI Gateway. Fixed versions are 19.2.4, 19.3.2, and 19.4.1; GitLab-hosted AI Gateways were already patched and need no action.

What happened

GitLab published the AI Gateway patch release on 2026-10-02 and rates the issue Critical. The affected component is the GitLab AI Gateway, the service that brokers GitLab Duo requests and constructs prompts and tool calls for the model backend.

• CVE: CVE-2026-90970, assigned by GitLab as CNA and published 2026-10-02.
• Weakness: CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine.
• CVSS v3.1: 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (GitLab; NVD, 2026-10-02).
• Reporter: invisiblemeerkat, who disclosed it through GitLab’s HackerOne program.
• Affected range: all AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1.

Source: GitLab advisory (2026-10-02); screenshot by AI Newsroom, 2026-10-10 via Playwright Chromium. License: GitLab Docs content is CC BY-SA 4.0.

Why it matters

The AI Gateway sits directly on the agent tool-call path, so a remote code execution (RCE) here runs with the gateway’s own privileges, inside the boundary meant to keep generated templates from touching the host. It is not a cosmetic or client-side bug.

Two aspects of the CVSS vector carry the severity. PR:L means the attacker must already be authenticated — but only with ordinary Duo Agent Platform access, not administrative rights. S:C (scope changed) records that the impact moves beyond the vulnerable component. GitLab’s guidance singles out self-managed installations that run their own gateway, not installations routing Duo through GitLab-hosted infrastructure.

How the flaw works

This is a server-side template injection (SSTI). Custom flow prompt templates process user-influenced input, and the template engine fails to neutralize special syntax that it then interprets as directives (CWE-1336).

GitLab describes the result as follows:

“an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway”

That is the extent of the public technical detail. GitLab published no payload or exploit chain, and this article does not add any. The advisory credits a single external reporter and does not describe an in-the-wild chain.

Who is affected and how to fix

Concrete steps:

1. Identify your gateway. Confirm whether your Duo deployment runs a self-hosted AI Gateway (/administration/gitlab_duo_self_hosted/) or a GitLab-hosted one. Only the self-hosted case is exposed.
2. Upgrade to a fixed version. Follow the self-hosted AI Gateway install documentation at docs.gitlab.com/install/install_ai_gateway/ to move to 19.2.4, 19.3.2, or 19.4.1.
3. Check your major line. The three fixed releases sit on the 19.2, 19.3, and 19.4 lines; 18.x installs are inside the affected range and should move to a 19.x fixed release.

GitLab says it contacted Self-Hosted AI Gateway customers directly before publishing the advisory.

Risks and caveats

• No exploitation reported. The CVE record’s CISA enrichment lists Exploitation: none and Automatable: no as of 2026-10-02 (CVE-2026-90970). The GitHub advisory lists an EPSS score of 0.943% (about the 60th percentile) (GHSA-5295-vp56-jghq). Neither is a forecast that the flaw will stay unexploited.
• Authentication is required, so the immediate blast radius is the set of users who can reach Duo Agent Platform on an exposed gateway — not anonymous internet traffic.
• The “first critical RCE in AI infrastructure” framing is not established. Some secondary coverage treated the flaw as notable because it targets AI-specific infrastructure. We found no primary source that supports a “first” claim; treat that framing as press characterization, not fact.
• NVD is still “Awaiting Analysis.” The 9.9 score in NVD comes from GitLab as the CVE source, not from an independent NVD analyst.

What to watch

• CISA KEV status. CVE-2026-90970 is not listed in CISA’s Known Exploited Vulnerabilities catalog as of 2026-10-10. Recheck; a KEV addition would normally tighten federal patch deadlines.
• A repeated pattern. The same CWE-1336 template-engine weakness in the same component family was patched earlier in 2026 as CVE-2026-1868 (Duo Workflow Service, fixed 18.6.2, 18.7.1, and 18.8.1, also CVSS 9.9). Two template-injection RCEs in one year is worth tracking as a design issue, not a one-off.
• Gateway audit posture. Inventory which teams run self-hosted gateways, who holds Duo Agent Platform access, and what network reach each gateway has. That inventory is what turns this advisory into a same-day patch decision.
• Public detail. Whether GitLab’s work item (628842) or the HackerOne report adds technical detail later.

Sources