Cybersecurity
GitLab fixes critical AI Gateway vulnerability
GitLab told customers to update Self-Hosted AI Gateway instances after finding CVE-2026-90970, a flaw that could let an authenticated user with Duo Agent Platform access run commands.
- GitLab said CVE-2026-90970 could let an authenticated user with Duo Agent Platform access execute arbitrary commands on affected AI Gateway installations.
- GitLab released versions 19.2.4, 19.3.2 and 19.4.1 for Self-Hosted AI Gateway users.
- GitLab said customers using its hosted AI Gateway did not need to take action.
- Last month GitLab patched CVE-2026-85706 in GitLab Community Edition and Enterprise Edition, and CISA later added it to its list of actively exploited flaws.
GitLab said it had fixed an issue in AI Gateway that, under certain conditions, could let an authenticated user with Duo Agent Platform access escape a prompt-template sandbox and run commands on the service. The company tracked the flaw as CVE-2026-90970.
AI Gateway provides access to GitLab Duo features. GitLab said it runs a hosted instance for GitLab.com, GitLab Self-Managed and GitLab Dedicated, and that users can also run their own instances through GitLab Duo Self-Hosted.
For self-hosted users, GitLab released versions 19.2.4, 19.3.2 and 19.4.1. It said hosted AI Gateway users were already protected and did not need to act.
GitLab also said it had contacted self-hosted customers before publishing the advisory and urged them to update affected systems quickly. It also noted that, last month, it had patched CVE-2026-85706 in Community Edition and Enterprise Edition, and that CISA added that flaw to its actively exploited list one day later under Binding Operational Directive 26-04.
Named in this story
Companies
- GitLab
- warned customers and released fixes
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added CVE-2026-85706 to its exploited list and set a deadline
- Binding Operational Directive 26-04
- the directive used for the federal remediation deadline
Products and systems
- AI Gateway
- the service with the vulnerability
- GitLab Duo
- the AI feature set accessed through AI Gateway
- GitLab Self-Managed
- one deployment route for AI Gateway
- GitLab Dedicated
- one deployment route for AI Gateway
- GitLab Duo Self-Hosted
- the option for self-hosted AI Gateway instances
- Duo Agent Platform
- the access level required for the exploit path
- CVE-2026-90970
- the identifier for the newly patched flaw
- GitLab Community Edition
- one product line patched last month
- GitLab Enterprise Edition
- one product line patched last month
- CVE-2026-85706
- the earlier flaw CISA marked as actively exploited
How the source tells it
A vendor security notice that stayed mostly factual but used urgent patch-now wording.
- urgency repeated calls for immediate updating and as soon as possible action
- threat framing the flaw was described in terms of arbitrary command execution on unpatched systems