GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances.
AI Gateway is a service that gives access to AI-native GitLab Duo features. While GitLab operates its own cloud-based AI Gateway instance used by GitLab.com, GitLab Self-Managed, and GitLab Dedicated, users can also deploy their own self-hosted instances on GitLab Self-Managed through GitLab Duo Self-Hosted.
Flaw allows arbitrary command execution
Tracked as CVE-2026-90970, this security flaw stems from an improper neutralization weakness and can let attackers with basic privileges and Duo Agent Platform access execute arbitrary commands on unpatched instances.
GitLab remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway. The company explained this in a Friday advisory.
Updates released for self-hosted users
GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to address this vulnerability for Self-Hosted AI Gateway users and said that customers using a GitLab-hosted AI Gateway are already protected and do not need to take action.
These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and the company strongly recommends that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately. GitLab added that it reached out to those who host their own AI Gateway before disclosure and urged users to upgrade vulnerable instances as soon as possible.
Read nextNvidia Share Price Reaches Record High and Pushes Market Value to $5.7 TrillionPast vulnerabilities highlight platform risks
Last month, GitLab also patched a maximum severity path traversal vulnerability tracked as CVE-2026-85706 in GitLab Community Edition and Enterprise Edition that allows unauthenticated attackers to read sensitive data such as credentials and other secrets from vulnerable servers.
One day later, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its list of actively exploited flaws and gave federal agencies three days to secure their systems as mandated by Binding Operational Directive 26-04. Since November 2021, CISA has tagged five GitLab vulnerabilities abused in the wild, including one exploited by ransomware gangs. GitLab's DevSecOps platform has over 30 million registered users and is used by over 50% of Fortune 100 companies, including Nvidia, Lockheed Martin, T-Mobile, Goldman Sachs, Airbus, and UBS.
GitLab urges users to upgrade vulnerable instances as soon as possible.
