GitLab AI Gateway Flaw: Patch This Critical Bug Now

A critical GitLab AI Gateway vulnerability (CVE-2026-90970) let logged-in users run arbitrary commands on self-hosted servers — GitLab has now patched it, and if you host your own gateway, you need to update today.

What Is the GitLab AI Gateway?

If your team uses GitLab with AI features, you probably use the AI Gateway without ever seeing it. It is the service that sits between your GitLab instance and the AI model providers, routing every AI-powered request — code suggestions, the Duo Agent Platform, custom AI workflows — to the right place.

Image: Darby via Wikimedia Commons (CC-BY-SA 4.0)

Most organizations let GitLab run this gateway for them (on GitLab.com or GitLab Dedicated). But some companies self-host the gateway — they run it on their own servers to keep AI request and response data inside their own environment. That self-hosted version is where this new flaw lives, and it is a serious one.

How the CVE-2026-90970 Vulnerability Works

Here is the plain-English version of what went wrong:

• The AI Gateway lets users build custom flows on the Duo Agent Platform — basically AI-powered workflows that automate multi-step tasks.
• Each flow has a prompt template, and templates run inside a sandbox: a sealed-off area meant to stop template code from touching anything else on the server.
• The bug let a logged-in user with Duo Agent Platform access escape that sandbox with a specially crafted flow configuration.
• Once out of the sandbox, the attacker could run arbitrary commands on the gateway server itself.

Why does that matter so much? Because a self-hosted gateway is a high-value target. It holds JWT signing keys (the secret tokens your systems use to prove who they are), it connects out to your GitLab instance, and it talks to every AI provider your company uses. An attacker who lands there has a foothold with real reach.

GitLab rated the flaw critical, with a CVSS score of 9.9 out of 10 — nearly the highest a single bug can get. The good news: as of October 2, CISA's assessment listed exploitation as "none," meaning there are no confirmed attacks in the wild yet. But with no workaround available, the window between disclosure and patching is the dangerous part. For more context on AI-related risks, see our more AI news section.

Who Needs to Patch Right Now (and Who Doesn't)

This is the part that saves most teams a headache. GitLab runs gateways for its cloud customers, and those are already fixed. You do not need to act if you are on:

• GitLab.com
• GitLab Dedicated
• A self-managed instance using a GitLab-hosted gateway

You do need to patch if your company hosts its own AI Gateway — that is the deployment carrying this flaw. GitLab notified self-hosted gateway customers directly before publishing the advisory.

The affected versions are the gateway builds from 18.1.6 up to (but not including) 19.2.4, plus the 19.3 and 19.4 lines before their fixes. Note the gap: there is no fixed version below 19.2.4, so if your gateway runs anything from the 18.1.6 through 19.1 lines, the fix means upgrading to a newer line.

How to Patch Your GitLab AI Gateway

The gateway ships as its own Docker image or Helm chart, so the update steps are separate from your main GitLab upgrade. Update to the fixed version matching your line:

• Line 19.2 → update to 19.2.4
• Line 19.3 → update to 19.3.2
• Line 19.4 → update to 19.4.1

Docker deployments: stop and remove the running container, then pull and run the new image tag (for example, self-hosted-v19.4.1-ee).

Helm deployments: change the tag in the chart's image setting, then deploy the release.

One important detail: match the gateway image to your GitLab minor version, following GitLab's install guide. And remember there is no workaround — if you cannot update yet, the advisory offers nothing to reduce risk in the meantime, so updating really is the only option.

What Security Teams Should Watch Next

A few honest gaps in this advisory are worth knowing:

• Older lines have no fix. GitLab has not said whether a 19.2.4 gateway works with GitLab 19.1 or earlier, or whether fixes for older lines are coming. If you are stuck on an old line, this should push the upgrade question up your priority list.
• No way to check for past compromise. The advisory gives no method for detecting whether a gateway was attacked before it was patched. Consider reviewing gateway logs for unusual flow configurations as a precaution.
• This looks like a pattern. In February, GitLab fixed CVE-2026-1868 — also rated 9.9, also reachable by a logged-in user through a crafted flow definition, and also a template-engine weakness of the same class (CWE-1336). AI gateways accept user-authored configurations while running with elevated access to credentials and model providers — a combination that keeps producing repeat findings.

This also follows GitLab's recent critical path-traversal flaw (CVE-2026-85706), which CISA added to its Known Exploited Vulnerabilities catalog. The bottom line: if your company self-hosts the AI Gateway, treat this patch as a today job, not a this-week job. For more stories like this, browse our more cybersecurity news coverage.

Sources: SC Media, Red Secure Tech, Hendry Adrian