CTI · reviewed · 2026-10-03

GitLab AI Gateway CVE-2026-90970 Critical Auth Escape

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://www.cve.org/CVERecord?id=CVE-2026-90970
• https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
• https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/
• https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html