Reported by 13 outlets
GitLab AI Gateway CVE-2026-90970 Critical Auth Escape
Why this score
- Breadth
- 2.00 / 2.0 · 13 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.33 / 0.6 · time to second source
- Recency
- × 0.32 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 3.1 / 10 = base × recency + community
Desk analysis
GitLab patched a critical AI Gateway vulnerability tracked as CVE-2026-90970 with CVSS 9.9. The flaw lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox and execute arbitrary commands on the AI Gateway host. Impacted versions span 18.1.6 through 19.2.3, 19.3 through 19.3.1, and 19.4 through 19.4.0; fixes are in 19.2.4, 19.3.2, and 19.4.1.
The advisory was published by GitLab as CNA and referenced in Canadian Cyber Centre alert AV26-994. CISA SSVC enrichment marks exploitation status as none and automatable as no as of the record update. Self-hosted AI Gateway customers should patch immediately because the vulnerability is a sandbox escape leading to arbitrary command execution.
Multiple secondary reports confirm the same technical details (prompt-template sandbox escape, arbitrary command execution, CVSS 9.9), so the event cluster is coherent rather than duplicated. Key CVEs in the broader story record include CVE-2026-85097 and CVE-2026-85706, but the current focus is CVE-2026-90970.
Timeline
-
original reporting
CVE-2026-90970: GitLab patched a critical flaw in its AI Gateway letting an authenticated user with Duo Agent Platform access escape the pro
www.cve.org · 11d ago · October 2nd, 2026
CVE-2026-90970: GitLab patched a critical flaw in its AI Gateway letting an authenticated user with Duo Agent Platform access escape the pro
via Mastodon https://www.cve.org/CVERecord?id=CVE-2026-90970
-
update from docs.gitlab.com
GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
docs.gitlab.com · 12d ago · October 2nd, 2026
GitLab's vendor advisory for CVE-2026-90970, surfaced via the docs.gitlab.com releases Atom feed. It releases Self-Hosted AI Gateway versions 19.2.4, 19.3.2, and 19.4.1, lists impacted versions as all from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1, and states a fix was already deployed for GitLab-hosted AI Gateways. The advisory carries CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), credits HackerOne researcher invisiblemeerkat with responsible disclosure, and notes GitLab conducted targeted outreach to Self-Hosted AI Gateway customers before publishing.
-
update from cve.org
CVE-2026-90970: Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
cve.org · 11d ago · October 2nd, 2026
The CVE record published by GitLab as CNA on 2026-10-02T14:34:49Z, twelve minutes before the story's first sighting, classified CWE-1336. It confirms the prompt template sandbox escape via a specially crafted flow configuration leads to arbitrary command execution on the AI Gateway. CISA's SSVC enrichment in the record marks Exploitation: none and Automatable: no as of its 2026-10-02T16:47Z update, with technical impact total. The record references GitLab work item 628842.
-
update from bleepingcomputer.com
GitLab warns of critical RCE vulnerability in AI Gateway service
bleepingcomputer.com · 11d ago · October 2nd, 2026
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. AI Gateway is a service that gives access to AI-native GitLab Duo features. While GitLab operates its own cloud-based AI Gateway instance used by GitLab.com, GitLab Self-Managed, and GitLab Dedicated, users can also deploy their own self-hosted instances on GitLab Self-Managed through GitLab Duo Self-Hosted. Tracked as CVE-2026-90970 , this security flaw stems from an improper neutralization weakness and can let attackers with basic privileges and Duo Agent Platform access execute arbitrary commands on unpatched instances. "GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway," the company explained in a Friday advisory. GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to address this vulnerability for Self-Hosted AI Gateway users and said that customers using a GitLab-hosted AI Gateway are already protected and do not need to take action. "These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediatel
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-90970 (critical): RCE in GitLab AI Gateway. An authenticated user with Duo Agent Platform access can escape the prompt template s
www.bleepingcomputer.com · 11d ago · October 2nd, 2026
-
update from malware.news
GitLab security advisory (AV26-994)
malware.news · 11d ago · October 2nd, 2026
Serial Number: AV26-994 Date: October 2, 2026 As of October 2, 2026, GitLab is affected by a vulnerability in the following product: GitLab AI Gateway Prior to 19.2.4 Prior to 19.3.2 Prior to 19.4.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
mentioned by thehackernews.com
🤖 GitLab patches CVE-2026-90970 (CVSS 9.9, critical) in the AI Gateway: a logged-in user with Duo Agent Platform access can run commands on
thehackernews.com · 11d ago · October 3rd, 2026
-
mentioned by www.bleepingcomputer.com
GitLab warns of critical RCE vulnerability in AI Gateway service GitLab warned customers today to immediately patch a critical AI Gateway vu
www.bleepingcomputer.com · 11d ago · October 3rd, 2026
-
mentioned by gbhackers.com
Critical GitLab AI Gateway Flaw Lets Attackers Execute Arbitrary Commands
gbhackers.com · 10d ago · October 3rd, 2026
-
update from beyondmachines.net
GitLab Issues Emergency Patches for Actively Exploited Critical AI Gateway and Path Traversal Flaws GitLab released emergency security updat
beyondmachines.net · 10d ago · October 3rd, 2026
GitLab Issues Emergency Patches for Actively Exploited Critical AI Gateway and Path Traversal Flaws GitLab released emergency security updat
via Mastodon https://beyondmachines.net/event_details/gitlab-issues-emergency-patches-for-actively-exploited-critical-ai-gateway-and-path-traversal-flaws-g-e-5-1-b/gD2P6Ple2L
-
mentioned by thecybersecguru.com
🚨 GitLab AI Gateway vulnerability: CVE-2026-90970 GitLab has patched a critical **CVSS 9.9** vulnerability in its AI Gateway that can allow
thecybersecguru.com · 10d ago · October 3rd, 2026
-
update from thecybersecguru.com
Critical GitLab AI Gateway RCE: CVE-2026-90970 https:// lemmy.world/post/52671589
thecybersecguru.com · 10d ago · October 3rd, 2026
Critical GitLab AI Gateway RCE: CVE-2026-90970 https:// lemmy.world/post/52671589
via Mastodon https://thecybersecguru.com/exploits/gitlab-ai-gateway-cve-2026-90970/
-
mentioned by linuxmint.hu
GitLab fixed a 9.9 CVSS severity AI Gateway vulnerability allowing an authenticated Duo Agent to run commands on the gateway
linuxmint.hu · 10d ago · October 3rd, 2026
-
update from thehackernews.com
If your business hosts its own GitLab AI tools, it is time for a quick update. A security flaw in the AI gateway could allow unauthorized co
thehackernews.com · 10d ago · October 3rd, 2026
If your business hosts its own GitLab AI tools, it is time for a quick update.
-
mentioned by threatnoir.com
⚠️ CRITICAL: GitLab warns of critical RCE vulnerability in AI Gateway service GitLab disclosed CVE-2026-90970, a critical RCE in AI Gateway
threatnoir.com · 9d ago · October 4th, 2026
-
mentioned by www.bleepingcomputer.com
# GitLab warns of critical RCE vulnerability in # AIGateway service https://www. bleepingcomputer.com/news/secu rity/gitlab-warns-of-critica
www.bleepingcomputer.com · 9d ago · October 4th, 2026
-
update from www.redhotcyber.com
GitLab fixes a 9.9 out of 10 bug in AI Gateway: here is what you need to know
www.redhotcyber.com · 9d ago · October 5th, 2026
GitLab fixes a 9.9 out of 10 bug in AI Gateway: here is what you need to know. Link to article: https://www.redhotcyber.com/post/gitlab-risolve-un-bug-da-99-su-10-in-ai-gateway-ecco-cosa-devi-sapere/
via Mastodon https://www.redhotcyber.com/post/gitlab-risolve-un-bug-da-99-su-10-in-ai-gateway-ecco-cosa-devi-sapere/
-
update from threatnoir.com
⚠️ CRITICAL: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE Bricksforge WordPress plugin (CVE-2026-8509
threatnoir.com · 1d ago · October 12th, 2026
⚠️ CRITICAL: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE Bricksforge WordPress plugin (CVE-2026-8509
via Mastodon https://threatnoir.com/focus
-
update from nvd.nist.gov
If users can write the flow config that fills your prompt template, the template engine is a code execution surface. GitLab AI Gateway, CVE-
nvd.nist.gov · 1d ago · October 12th, 2026
If users can write the flow config that fills your prompt template, the template engine is a code execution surface. GitLab AI Gateway, CVE-
via Mastodon https://nvd.nist.gov/vuln/detail/CVE-2026-90970