CVE-2026-90970: GitLab AI Gateway let Duo Agent Platform users escape the prompt template sandbox and run commands

Vulnerability · GitLab AI Gateway (Duo Agent Platform) · CRITICAL

Incident dateNot stated

DisclosedOct 2, 2026 (GitLab AI Gateway critical patch release; NVD and BleepingComputer the same day).

Added hereOct 15, 7:34 AM ET

Last verifiedOct 15, 2026

Summary

GitLab fixed CVE-2026-90970 in GitLab AI Gateway 19.2.4, 19.3.2 and 19.4.1, released Oct 2, 2026. The AI Gateway is the service that gives GitLab Duo its AI features. GitLab says an authenticated user with Duo Agent Platform access could escape the prompt template sandbox with a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway. GitLab rates it CVSS 9.9 Critical. Only self-hosted AI Gateway installations need to update: GitLab.com, GitLab Dedicated and Self-Managed instances that use a GitLab-hosted AI Gateway already have the fix.

Severity

CRITICAL GitLab scores it CVSS 3.1 9.9 Critical: network attack, low complexity, low privileges, no user interaction, a scope change, and high impact on confidentiality, integrity and availability. An attacker needs a GitLab account with Duo Agent Platform access, and only self-hosted AI Gateway installations are exposed. GitLab's advisory does not mention exploitation.

Timeline

Before Oct 2, 2026
GitLab contacts customers who run a self-hosted AI Gateway with upgrade guidance, ahead of the public release post (per GitLab).
Oct 2, 2026
GitLab releases AI Gateway 19.2.4, 19.3.2 and 19.4.1 and publishes a critical patch advisory for CVE-2026-90970. GitLab-hosted AI Gateways already run the fix.
Oct 2, 2026
NVD publishes CVE-2026-90970 (15:17 UTC). BleepingComputer reports the advisory the same day.

How it happened

GitLab's advisory calls it an improper neutralization issue in the custom flow prompt template. The AI Gateway renders prompt templates inside a sandbox, and a user who could submit a specially crafted flow configuration could break out of that sandbox and run commands on the gateway itself. The CVE record lists CWE-1336 (improper neutralization of special elements used in a template engine). Affected versions are AI Gateway 18.1.6 up to 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. GitLab credits the researcher invisiblemeerkat for reporting it and has not published further technical detail. The NVD record links GitLab work item #628842, which was not public when we checked.

How to check your app

If you run a self-hosted GitLab AI Gateway (GitLab Duo Self-Hosted), upgrade it to 19.2.4, 19.3.2 or 19.4.1 or later.
GitLab.com, GitLab Dedicated and Self-Managed instances that use a GitLab-hosted AI Gateway do not need to act.
Review which users have Duo Agent Platform access and who can create or change custom flows.
If your gateway ran an affected version, review its logs and host for commands or outbound connections you do not recognize.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.