IT SBIT Services
Schneeberger
DEEN
CVE tracker

GitLab AI Gateway: Template sandbox escape enables command execution

CVE-2026-90970Critical 9.9Public exploit

← All vulnerabilities

Summary

GitLab AI Gateway contains a flaw in the handling of custom flow prompt templates (CWE-1336). An authenticated user with Duo Agent Platform access can escape the prompt template sandbox using a specially crafted flow configuration and execute arbitrary commands on the AI Gateway host. The vendor states this applies only under certain conditions, which it does not specify. The gateway host of a self-hosted instance holds JWT signing keys and model-provider credentials, so the impact is high.

Affected

  • GitLab AI Gateway 18.1.6 before 19.2.4
  • GitLab AI Gateway 19.3 before 19.3.2
  • GitLab AI Gateway 19.4 before 19.4.1
  • Only self-hosted gateways are affected; GitLab-hosted gateways already have the fix.

Fixed in

  • 19.2.4, 19.3.2 or 19.4.1, or a later release on the same line
  • Unconfirmed: one secondary source says there is no patch for 19.1 and earlier. Treat 18.x, 19.0 and 19.1 as unpatched and upgrade them to a fixed line.

Workaround

Unknown. No vendor workaround is published; patching is the stated remedy.

Exploitation

  • CISA SSVC on the CVE record: exploitation none, automatable no, technical impact total.
  • GitLab does not state that the flaw has been exploited.
  • Not listed in the CISA Known Exploited Vulnerabilities catalogue as of early October 2026.
  • Claims of a public proof of concept or active exploitation are unverified and conflicting.

Our recommendation

  • Check whether any client operates a self-hosted AI Gateway and which version.
  • Upgrade to 19.2.4, 19.3.2, 19.4.1 or later on the matching line; move 18.x, 19.0 and 19.1 instances to a fixed line.
  • Review who holds Duo Agent Platform access and reduce it to what is required, including who can author custom flow configurations.
  • Check whether the gateway is reachable from outside your network and restrict access.
  • Review gateway logs for unusual flow configurations.
  • Monitor the NVD record and the vendor advisory for changes.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:44.

Original description (NVD)

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed