# GitLab Users With Agent Platform Access Could Run Commands on Its Self-Hosted AI Gateway

_GitLab fixed CVE-2026-90970 on October 2, 2026. A signed-in user with access to its Duo Agent Platform could use a crafted flow configuration to run arbitrary commands on a self-hosted AI Gateway, the server that issues the signed tokens authorizing GitLab Duo requests. GitLab rates it 9.9._

By Johannes Keienburg, CEO & Founder  
Published: 2026-10-15  
Source: https://www.cakewalk.security/blog/gitlab-ai-gateway-cve-2026-90970

---

## A Crafted Agent Workflow Could Run Commands on GitLab's Self-Hosted AI Gateway

On October 2, 2026, GitLab fixed a critical flaw in the self-hosted version of its [AI Gateway](/glossary/ai-gateway), the server that carries GitLab's AI requests to the model providers a company configures. GitLab's Duo Agent Platform lets teams build workflows, called flows, from AI agents. A signed-in user with Duo Agent Platform access could use a crafted flow configuration to run arbitrary commands on the gateway. Companies running GitLab on their own servers host this version of the gateway themselves. GitLab tracks the flaw as CVE-2026-90970, its ID in the CVE list that catalogs publicly disclosed vulnerabilities. It rates the flaw 9.9 on CVSS, a 0-to-10 severity scale on which 9.0 and above counts as critical. Access meant for building agent workflows could be enough to run commands on the server that issues the signed tokens authorizing GitLab Duo requests.

> GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.

_GitLab, AI Gateway critical patch release, October 2, 2026_

GitLab's advisory does not describe what an attacker could reach on the gateway. Self-hosted gateways from version 18.1.6 up to the fixed versions are affected. The fixed versions are 19.2.4, 19.3.2 and 19.4.1. GitLab says it contacted self-hosted customers before publishing the advisory. The fix is already live on the gateways GitLab hosts, which serve GitLab.com, GitLab Dedicated and self-managed instances connected to them. On October 2, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an entry to the CVE record that lists exploitation as none.

## The Gateway Holds the Keys That Sign GitLab Duo Tokens

GitLab's install guide explains what a self-hosted gateway holds. The gateway uses signed tokens to confirm that each request comes from an authenticated user on the GitLab instance. A company generates the signing keys itself and passes them to the gateway as environment variables. The gateway also needs outbound access to the company's model providers. An earlier article covered [the attack surface of AI gateways](/blog/ai-gateway-security-attack-surface) in general.

> These keys are used for signing JWTs and must be treated as sensitive credentials.

_GitLab, Install the GitLab AI Gateway_

In February, GitLab fixed a flaw of the same class in the same gateway, CVE-2026-1868. Rated 9.9 as well, it let crafted Duo Agent Platform flow definitions cause denial of service or code execution on the gateway. Both records name the same weakness class, in which a template engine fails to neutralize special elements in input.

> Permission to configure an agent platform is admin power over whatever runs on it. Here it could be enough to run commands on GitLab's AI Gateway. Configuring agents should be a granted permission tied to a named person and kept to what the job needs. The MCP Gateway carries agents' tool calls to apps and evaluates each governed call against policy before it runs. It holds credentials too, so who may configure it is an access decision as well. One record holds which governed calls were allowed, denied or escalated.

_Comment from Gil Röder, CPO & Co-Founder_

Source: GitLab, [GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/), October 2, 2026.