GitLab has issued emergency fixes for a critical vulnerability in its self-hosted AI Gateway that could allow a logged-in user to break out of a prompt template sandbox and run arbitrary commands on the gateway server itself. The flaw, tracked as CVE-2026-90970, carries a near-maximum CVSS score of 9.9 out of 10.
The company disclosed the bug on October 2 and has shipped patched releases numbered 19.2.4, 19.3.2 and 19.4.1. The vulnerability sits in the custom-flow prompt templates used by the Duo Agent Platform: under certain conditions, an authenticated user with access to that platform could submit a specially crafted flow configuration and escape the template sandbox, GitLab said in its advisory.
Once the sandbox is breached, the crafted input effectively runs as code on the gateway host. Security analysts note that successful command execution could expose sensitive server material, including JWT signing keys stored in environment variables, potentially giving an attacker control over how downstream AI requests are authenticated.
The realistic threat here is not a random internet stranger. Exploitation requires a logged-in account with Duo Agent Platform privileges, and in most organizations a large share of developers hold exactly those permissions. A malicious insider or a single compromised developer account is enough to make the attack work.

Who needs to act — and who is already safe

Only organizations that host their own AI Gateway need to act. GitLab.com, GitLab Dedicated, and self-managed instances that point at a GitLab-hosted gateway are already patched, and the company says it contacted affected self-hosted customers directly before publishing the advisory.
For those self-hosting, GitLab strongly recommends upgrading immediately to 19.2.4, 19.3.2 or 19.4.1, depending on the supported release branch in use. Affected versions span from 18.1.6 up through 19.2.3, plus the 19.3 branch before 19.3.2 and the 19.4 branch before 19.4.1.
Administrators should verify the deployed AI Gateway image or Helm configuration rather than assuming that upgrading the main GitLab application alone removes the exposure, because the gateway is a separate component from the core GitLab application.
So far there is no evidence the flaw has been exploited. The advisory does not say whether it has been used in attacks, and the U.S. Cybersecurity and Infrastructure Security Agency listed exploitation as "none" in its CVE assessment on October 2. No public proof of concept is known, and the flaw does not appear in CISA's catalog of actively exploited vulnerabilities.

The second 9.9 gateway flaw this year

The bug was reported through HackerOne by a researcher using the handle invisiblemeerkat. It is the second CVSS 9.9 flaw in GitLab's AI Gateway this year: in February, the company patched CVE-2026-1868, another sandbox escape in the same flow-definition template handling. Both stem from the same class of template-engine weakness.
That pattern matters because the AI Gateway is the service that connects a GitLab instance to AI models — it routes requests from the Duo assistant to whichever large language model a customer has chosen to run. A takeover could expose the prompts, code and model credentials passing through it.
The disclosure also arrives weeks after GitLab rushed out fixes for two critical server flaws in its enterprise product, including a September path-traversal flaw that landed on CISA's actively exploited list. For security teams, the message is consistent: keep the gateway, and everything around the AI toolchain, updated.