Kalyxo
GitLab patches critical AI Gateway sandbox escape
Published
A critical flaw could let an authenticated Duo Agent Platform user run commands on a self-hosted GitLab AI Gateway. GitLab-hosted gateways were already patched.
GitLab disclosed CVE-2026-90970 on October 2, 2026, assigning the vulnerability a CVSS score of 9.9. Under certain conditions, an authenticated user with Duo Agent Platform access could escape the prompt-template sandbox through a crafted flow configuration and execute arbitrary commands on the AI Gateway. GitLab describes the issue in its AI Gateway 19.4.1 patch release; the Canadian Centre for Cyber Security published a matching advisory.
Which gateways need an update
GitLab lists affected versions starting at 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. Fixed releases are 19.2.4, 19.3.2, and 19.4.1. Operators of a self-hosted AI Gateway should identify its version and update to the appropriate fixed release.
GitLab says it already updated GitLab-hosted AI Gateways. That includes GitLab.com, GitLab Dedicated, and Self-Managed instances that use GitLab-hosted Gateway. Those deployments need no action for this advisory. The distinction is the gateway’s hosting model, not whether the GitLab instance itself is hosted or self-managed.
Treat orchestration as a security boundary
This flaw concerns the service that interprets agent flow configuration and processes prompt templates. Those operations can cross from structured instructions into executable behavior. The security boundary therefore includes who may define flows, how templates are isolated, and what the gateway process can reach.
Self-hosted operators should inventory the Gateway separately from the main application, verify its version after updating, and restrict who can author flow configurations. A GitLab instance’s hosting label alone does not tell an operator where its AI Gateway runs. Where the service runs as a separate image or package, confirm that component’s own version. Track which projects or users can author flows so an authenticated path is not confused with unrestricted access. Limit the gateway’s credentials and network destinations to what the deployment requires. These are practical implications of the execution path. The cited advisories do not report active exploitation.