CVE-2026-1868

GitLab Duo Workflow Service insecure template expansion

GitLab · GitLab AI Gateway / Duo Workflow Service

First documented disclosure · Review checkpoint

Summary

A separate February AI Gateway flaw allowed authenticated users to reach unsafe template expansion through Duo flow definitions.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

User-controlled flow data reaches insecure template expansion.

Conditions required

Authenticated access to the GitLab instance and a vulnerable self-hosted AI Gateway.

Potential impact

Gateway code execution or denial of service.

Affected versions and configurations

CNA version ranges: 18.1.6 to before 18.6.2; 18.7.0 to before 18.7.1; 18.8.0 to before 18.8.1.

Fix and mitigation status

18.6.2, 18.7.1 and 18.8.1.

Practical next steps

Use a currently supported patched gateway; the October CVE-2026-90970 requires later fixes on affected branches.

Operating lesson

A previous patch for a vulnerability class does not establish protection from subsequent variants.

Evidence and limits

February 6 vendor disclosure predates the February 9 CNA publication. This is distinct from CVE-2026-90970.

Sources