Agentic Cyber Explorerby Fide AI · PreviewPreview
Chronicle/Attacks & incidents

GitLab discloses a critical AI Gateway flaw letting a Duo Agent Platform user run commands on self-hosted gateways (CVE-2026-90970)

AttackVulnerability disclosureSignificance assistant-drafted

GitLab, as the CVE numbering authority, published CVE-2026-90970 on 2026-10-02: in the AI Gateway component, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox through a specially crafted flow configuration and run arbitrary commands on the gateway. The CVE record rates it critical (CVSS 3.1 base score 9.9) and lists fixes in versions 19.2.4, 19.3.2 and 19.4.1. The record also carries a CISA assessment, added the same day, that lists exploitation as none; The Hacker News adds that only organizations hosting their own gateway need to act.

Why it matters

It shows an agent platform's template sandbox standing between an authenticated user and command execution on a service that holds signing keys and links to model providers.

Key facts

As stated in the sources, with where to find them.

  • The CVE record, published by GitLab on 2026-10-02 (CWE-1336, improper neutralization of special elements used in a template engine), affects the GitLab AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2 and 19.4 before 19.4.1, and says that under certain conditions an authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.CVE record, description and affected versions
  • The CVE record gives CVSS 3.1 base score 9.9 (critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and the solution as upgrading to 19.2.4, 19.3.2, 19.4.1 or above. It lists no workaround. The record credits a HackerOne researcher (handle invisiblemeerkat) as the finder.CVE record, metrics, solutions and credits
  • A CISA entry attached to the CVE record on 2026-10-02 lists exploitation as none, not automatable, and technical impact total. That is an assessment as of that date, not evidence of absence; GitLab's own part of the record says nothing about exploitation.CVE record, CISA-ADP SSVC entry
  • The Hacker News reports that the flaw is in the prompt template of a custom flow, an AI workflow users create on the Duo Agent Platform, and that GitLab says it already fixed the gateways it runs: GitLab.com, GitLab Dedicated and self-managed instances using a GitLab-hosted gateway need no action, while self-managed customers hosting their own gateway are urged to update.The Hacker News, opening paragraphs and What Is Known About the Flaw
  • The Hacker News reports that GitLab fixed a February 2026 gateway flaw, CVE-2026-1868, also rated 9.9 and reachable through a crafted flow definition, and that both are template-engine weaknesses of the same class (CWE-1336); it says the 2026-10-02 notice does not mention the earlier flaw.The Hacker News, What Is Known About the Flaw

Findings that cite this record

No tracked finding cites this record yet.

Sources

Related records