GitLab has released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1 to fix CVE-2026-90970, a CVSS 9.9 flaw that lets an authenticated user with Duo Agent Platform access run arbitrary commands on a self-hosted AI Gateway. If you run your own gateway, the people who can reach it through Duo Agent Platform are effectively the people who can run code on it until you upgrade.
What happened
GitLab's patch release describes an improper neutralization issue in the custom flow prompt template. A user with Duo Agent Platform access can escape the prompt template sandbox by submitting a specially crafted flow configuration, and the result is arbitrary command execution on the AI Gateway. The AI Gateway is the service that provides access to GitLab Duo's AI features. The Hacker News and BleepingComputer both classify the bug as CWE-1336, a template engine weakness.
The details from GitLab's release:
- CVSS: 9.9, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Low privileges are required, no user interaction is needed, and the scope is changed. - Affected: AI Gateway versions 18.1.6 through 19.2.3, 19.3 before 19.3.2, and 19.4 before 19.4.1.
- Fixed: 19.2.4, 19.3.2 and 19.4.1.
- Who needs to act: only organizations running a Self-Hosted AI Gateway. GitLab says GitLab.com, GitLab Dedicated, and Self-Managed instances that use the GitLab-hosted AI Gateway are already patched and need no action.
- Credit: reported through HackerOne by invisiblemeerkat.
GitLab's release doesn't mention exploitation. The Hacker News reports that CISA's assessment on October 2 listed exploitation as "none." BleepingComputer reports that GitLab did targeted outreach to Self-Hosted AI Gateway customers before publishing. GitLab doesn't list any workaround, so upgrading is the fix.
Why it matters
The attacker in this bug isn't an outsider. It's any account that has been granted Duo Agent Platform access. That shifts the question from "is the gateway exposed to the internet" to "who has been handed agent access, and do we review that list." AI feature access often gets rolled out broadly to drive adoption, without the scrutiny a request for shell access to a server would get. This flaw turns one into the other.
The "scope changed" part of the CVSS vector also matters: the impact reaches past the flow being edited to the gateway itself. GitLab's advisory doesn't say what an attacker could reach from there. That depends on your deployment, which is why it's worth knowing before the next one of these lands.
This is also a pattern. The Hacker News notes an earlier CVSS 9.9 AI Gateway flaw in the same weakness class from February 2026. User-editable agent flows and prompt templates are now code paths, and they need the same input-handling and least-privilege review as any other place users can submit logic.
What to check in your environment
- Confirm which gateway you use. If your Self-Managed instance points at the GitLab-hosted AI Gateway, GitLab says you're covered. If you run a Self-Hosted AI Gateway, you need to act.
- Check the gateway version. Anything from 18.1.6 through 19.2.3, 19.3.0–19.3.1, or 19.4.0 is vulnerable. Upgrade to 19.2.4, 19.3.2 or 19.4.1 using GitLab's Self-Hosted AI Gateway install documentation.
- Review who has Duo Agent Platform access. Until you've patched, every one of those users can run commands on the gateway. Remove access nobody is using, and include service and bot accounts in the review.
- Look at custom flow configurations. Review recently created or changed custom flows, especially ones from accounts that don't normally build them.
- Inventory what the gateway host can reach. List the credentials and network paths available to the gateway. Scope down or isolate anything that would be dangerous in someone else's hands.
- Check for GitLab's outreach. If you run a self-hosted gateway and nobody received GitLab's pre-release notice, find out where it went and make sure the right owner is on the contact list.