GitLab fixes a 9.9-severity flaw that let users escape its AI Gateway's prompt-template sandbox and run commands
Any signed-in user with access to the Duo Agent Platform could exploit it on a self-hosted gateway. Gateways GitLab hosts are already protected.
GitLab released versions 19.2.4, 19.3.2 and 19.4.1 of its AI Gateway, the service behind its Duo AI features, to fix CVE-2026-90970. Its advisory scores the flaw 9.9 out of 10.
According to the advisory, an authenticated user with access to the Duo Agent Platform could escape the prompt-template sandbox with a specially crafted flow configuration and run arbitrary commands on the AI Gateway. Affected are all versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. The researcher invisiblemeerkat reported it through HackerOne.
GitLab says customers on GitLab.com, Dedicated and Self-Managed who use a GitLab-hosted AI Gateway are protected and do not need to take action. Companies running their own gateway need to upgrade.
GitLab's advisory page carries no date. The CVE record, as shown on the Strix vulnerability tracker, was published on 2 October. No report of exploitation was found.
The flaw sits in the layer that lets customers define their own agent workflows. That is where developer tools are adding agent features fastest, and a template meant to shape a prompt became a way to run code on the server. It is the second critical flaw in agent orchestration software disclosed on the same day, after AWS's bulletin on Loom.
Today in the October 3, 2026 edition · front page