Skip to content
Today
Sections

Security Independently confirmed4 publishers 2 min read Published Updated

GitLab patches sandbox escape that lets Duo agent users run commands on self-hosted AI Gateways

GitLab patched CVE-2026-90970, a sandbox escape that lets any authenticated Duo Agent Platform user run arbitrary commands on a self-hosted AI Gateway. Customers on GitLab's hosted gateway are already protected, so the upgrade falls to Self-Managed shops that run their own.

The Watch · Security desk

Send a correction

Illustration accompanying GitLab patches sandbox escape that lets Duo agent users run commands on self-hosted AI Gateways
Generated illustration

What happened

  • BleepingComputer reports the flaw is an improper neutralization weakness that needs only basic privileges on top of Duo Agent Platform access.
  • GitLab says it contacted Self-Hosted AI Gateway customers with upgrade guidance before it published the release post.
  • CISA has flagged five GitLab vulnerabilities as exploited in the wild since November 2021, one of them by ransomware gangs.

Why it matters

  • Who's exposed exposure Any account holding a Duo Agent Platform seat, whether an insider's or one taken over with stolen credentials, is enough to reach command execution on a self-hosted gateway.
  • What it costs cost Fixes ship on three release lines, so a self-hosted gateway on 19.2, 19.3 or 19.4 can be patched within its current line.
  • What it sets up precedent GitLab's previous critical went from patch to a federal deadline in four days, one to reach CISA's exploited list and three more for agencies. A listing for this flaw would start a similar clock.

GitLab's Friday advisory [9] said the flaw "under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway" [3]. The attacker's input is a flow configuration, submitted with access the attacker already holds [3]. Those commands run on the gateway, the service that gives access to GitLab Duo's AI features [5].

Only part of GitLab's user base is exposed. GitLab reports more than 30 million registered users and use at over half of the Fortune 100 [13]. Its own cloud gateway serves GitLab.com, Self-Managed and Dedicated customers. The vulnerable installs are the separate gateways that Self-Managed customers deploy themselves through GitLab Duo Self-Hosted [5]. BleepingComputer's report does not say how many such gateways exist, or that CVE-2026-90970 has been exploited [10].

For operators who do run one, the instruction is to upgrade now. "These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately," the company said [7].

Last month's critical is the comparison point. CVE-2026-85706, a maximum-severity path traversal in GitLab Community and Enterprise Edition, let unauthenticated attackers read credentials and other secrets from servers [11]. CISA added it to its actively exploited list under BOD 26-04 [12]. That bug needed no login. This one needs a logged-in user with agent access [3]. In return it gives command execution on the gateway, where last month's bug gave reads of stored secrets [3][11].

What to watch

  • A CISA listing of CVE-2026-90970 as actively exploited, and the BOD 26-04 deadline attached to it.
  • Public detail on the "certain conditions" GitLab cites, or a proof of concept for the crafted flow configuration.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence74

Perspective Coverage

4 publishers
Builder
Builder 24%
Operator
Operator 59%
Investor
Investor 17%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    GitLab warned customers to immediately patch a critical AI Gateway vulnerability, tracked as CVE-2026-90970, that could let attackers run arbitrary commands on vulnerable instances.

    Reported SupportedView cited source
  2. [2]

    CVE-2026-90970 stems from an improper neutralization weakness and can let attackers with basic privileges and Duo Agent Platform access execute arbitrary commands on unpatched instances.

    Reported Supported Source: BleepingComputerView cited source
  3. [3]

    "GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway."

    Reported Supported Source: GitLab advisory, as quoted by BleepingComputerView cited source
  4. [4]

    GitLab released versions 19.2.4, 19.3.2 and 19.4.1 to address the vulnerability for Self-Hosted AI Gateway users.

    Reported SupportedView cited source
  5. [5]

    AI Gateway is a service that gives access to AI-native GitLab Duo features. GitLab operates its own cloud-based AI Gateway instance used by GitLab.com, GitLab Self-Managed and GitLab Dedicated; users can also deploy their own self-hosted instances on GitLab Self-Managed through GitLab Duo Self-Hosted.

    Reported SupportedView cited source
  6. [6]

    "We have conducted targeted outreach to Self-Hosted AI Gateway customers prior to this release post with this guidance."

    Reported Supported Source: GitLab, as quoted by BleepingComputerView cited source
  7. [7]

    "These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately."

    Reported Supported Source: GitLab, as quoted by BleepingComputerView cited source
  8. [8]

    Customers using a GitLab-hosted AI Gateway are already protected and do not need to take action.

    Reported Supported Source: GitLab, via BleepingComputerView cited source
  9. [9]

    GitLab disclosed the CVE-2026-90970 fix in a Friday advisory.

    Reported SupportedView cited source
  10. [10]

    BleepingComputer's report does not state that CVE-2026-90970 has been exploited in the wild and does not give a count of self-hosted AI Gateway installations.

    Reported Supported Source: Absence in the BleepingComputer reportView cited source
  11. [11]

    Last month GitLab patched a maximum severity path traversal vulnerability, CVE-2026-85706, in GitLab Community Edition and Enterprise Edition that allows unauthenticated attackers to read sensitive data such as credentials and other secrets from vulnerable servers.

    Reported SupportedView cited source
  12. [12]

    One day after the patch, CISA added CVE-2026-85706 to its list of actively exploited flaws and gave federal agencies three days to secure their systems under Binding Operational Directive 26-04.

    Reported SupportedView cited source
  13. [13]

    GitLab's DevSecOps platform has over 30 million registered users and is used by over 50% of Fortune 100 companies.

    Reported Supported Source: BleepingComputer, citing GitLab figuresView cited source
  14. [14]

    Since November 2021, CISA has tagged five GitLab vulnerabilities as abused in the wild, including one exploited by ransomware gangs.

    Reported SupportedView cited source
  15. [15]

    The CVE-2026-90970 fixes ship as point releases on three release lines: 19.2, 19.3 and 19.4.

    Derived Supported
  16. [16]

    CVE-2026-85706 went from GitLab's patch to the federal remediation deadline in four days.

    Derived Supported

Sources

4 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 2, 2026

    GitLab warns of critical RCE vulnerability in AI Gateway service
  2. scworld.com

    1 article · October 3, 2026

    GitLab warns of critical AI Gateway vulnerability allowing command execution
  3. securityaffairs.com

    1 article · October 3, 2026

    CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
  4. thehackernews.com

    2 articles · October 3, 2026

    GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

Topics and entities

Topics

Entities