CVE-2026-90970

GitLab AI Gateway custom-flow sandbox escape

GitLab · GitLab AI Gateway

First documented disclosure · Review checkpoint

Summary

GitLab disclosed a critical template-sandbox escape affecting its self-hosted AI Gateway. GitLab-hosted gateways were already patched.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A crafted flow configuration escapes the prompt template sandbox.

Conditions required

Authenticated Duo Agent Platform access and an affected AI Gateway.

Potential impact

Arbitrary commands on the AI Gateway.

Affected versions and configurations

18.1.6–before 19.2.4; 19.3–before 19.3.2; 19.4–before 19.4.1.

Fix and mitigation status

19.2.4, 19.3.2 or 19.4.1 for the corresponding branch.

Practical next steps

Patch the AI Gateway component and verify its version separately from the GitLab application.

Operating lesson

Inventory AI gateways as independent services with their own patch ownership.

Evidence and limits

CNA publication is October 2; later Reddit and European coverage are discovery/corroboration, not new disclosures.

Sources