GitLab Users With Agent Platform Access Could Run Commands on Its Self-Hosted AI Gateway
1A Crafted Agent Workflow Could Run Commands on GitLab's Self-Hosted AI Gateway
On October 2, 2026, GitLab fixed a critical flaw in the self-hosted version of its AI Gateway, the server that carries GitLab's AI requests to the model providers a company configures. GitLab's Duo Agent Platform lets teams build workflows, called flows, from AI agents. A signed-in user with Duo Agent Platform access could use a crafted flow configuration to run arbitrary commands on the gateway. Companies running GitLab on their own servers host this version of the gateway themselves. GitLab tracks the flaw as CVE-2026-90970, its ID in the CVE list that catalogs publicly disclosed vulnerabilities. It rates the flaw 9.9 on CVSS, a 0-to-10 severity scale on which 9.0 and above counts as critical. Access meant for building agent workflows could be enough to run commands on the server that issues the signed tokens authorizing GitLab Duo requests.
GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.
GitLab, AI Gateway critical patch release, October 2, 2026
GitLab's advisory does not describe what an attacker could reach on the gateway. Self-hosted gateways from version 18.1.6 up to the fixed versions are affected. The fixed versions are 19.2.4, 19.3.2 and 19.4.1. GitLab says it contacted self-hosted customers before publishing the advisory. The fix is already live on the gateways GitLab hosts, which serve GitLab.com, GitLab Dedicated and self-managed instances connected to them. On October 2, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an entry to the CVE record that lists exploitation as none.
2The Gateway Holds the Keys That Sign GitLab Duo Tokens
GitLab's install guide explains what a self-hosted gateway holds. The gateway uses signed tokens to confirm that each request comes from an authenticated user on the GitLab instance. A company generates the signing keys itself and passes them to the gateway as environment variables. The gateway also needs outbound access to the company's model providers. An earlier article covered the attack surface of AI gateways in general.
These keys are used for signing JWTs and must be treated as sensitive credentials.
GitLab, Install the GitLab AI Gateway
In February, GitLab fixed a flaw of the same class in the same gateway, CVE-2026-1868. Rated 9.9 as well, it let crafted Duo Agent Platform flow definitions cause denial of service or code execution on the gateway. Both records name the same weakness class, in which a template engine fails to neutralize special elements in input.
Source: GitLab, GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1, October 2, 2026.