{"id":3344,"date":"2026-10-02T17:58:54","date_gmt":"2026-10-02T17:58:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3344"},"modified":"2026-10-02T17:58:54","modified_gmt":"2026-10-02T17:58:54","slug":"gitlab-patches-critical-9-9-ai-gateway-flaw-allowing-command-execution-on-self-hosted-servers","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3344","title":{"rendered":"GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Oct 02, 2026<\/span><\/span>Vulnerability \/ Application Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory<\/a>.<\/p>\n

The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.<\/p>\n

The flaw is tracked as CVE-2026-90970<\/a>. GitLab disclosed it on October 2 and rated it critical, with a CVSS score of 9.9 out of 10.<\/p>\n

GitLab runs AI Gateways for its customers and has already fixed them. Customers on GitLab.com, GitLab Dedicated, and self-managed instances that use a GitLab-hosted gateway do not need to act, the company said.<\/p>\n

Self-managed customers can instead host their own gateway<\/a>, an option GitLab offers for keeping AI request and response data inside the customer’s own environment. GitLab strongly recommends that those customers update immediately. It sent that guidance to customers with self-hosted gateways before it published the advisory.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The advisory does not say whether the flaw has been used in attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an assessment to the CVE record on October 2 that lists exploitation as \u00abnone.\u00bb CISA’s other two values cover a public proof of concept and active exploitation.<\/p>\n

<\/p>\n

Affected and Fixed Versions<\/h3>\n

The versions below are AI Gateway versions. The gateway is installed as its own Docker image or Helm chart and has its own update steps.<\/p>\n\n\n\n\n\n\n
\n Gateway version in use\n <\/th>\n\n First fixed version\n <\/th>\n<\/tr>\n
\n 18.1.6 or later, before 19.2.4\n <\/td>\n\n 19.2.4\n <\/td>\n<\/tr>\n
\n 19.3, before 19.3.2\n <\/td>\n\n 19.3.2\n <\/td>\n<\/tr>\n
\n 19.4, before 19.4.1\n <\/td>\n\n 19.4.1\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

To update a Docker deployment<\/a>, stop and remove the running container, then pull and run the new image tag, for example self-hosted-v19.4.1-ee. Helm deployments set the new tag in the chart’s image setting.<\/p>\n

No fixed version is listed below 19.2.4. That leaves every gateway release from 18.1.6 through the 19.1 line inside the affected range.<\/p>\n

GitLab’s install guide tells administrators to use the gateway image that matches their GitLab minor version. The advisory does not say whether a 19.2.4 gateway works with GitLab 19.1 or earlier, or whether fixes for the older lines are planned.<\/p>\n

As of October 2, GitLab’s maintenance policy<\/a> listed 19.4, 19.3, and 19.2 as the GitLab releases that get security fixes. Those are the same three lines that got the gateway fix.<\/p>\n

No workaround is listed for gateways that cannot be updated yet. The advisory also gives no way to check whether a gateway was attacked before it was updated.<\/p>\n

What Is Known About the Flaw<\/h3>\n

The flaw is in the prompt template of a custom flow, according to the advisory’s title. A custom flow is an AI-powered workflow that users create on the Duo Agent Platform to automate multi-step tasks.<\/p>\n

A logged-in user with Duo Agent Platform access could have used the flaw to \u00abescape the prompt template sandbox via a specially crafted flow configuration,\u00bb GitLab said. The escape could lead to arbitrary command execution on the gateway.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The conditions the attack needs are not described, and no user role is named beyond Duo Agent Platform access.<\/p>\n

A self-hosted gateway holds signing keys for JSON Web Tokens (JWT), which GitLab’s install guide says must be treated as sensitive credentials. It also connects to the GitLab instance and to the organization’s AI model providers.<\/p>\n

GitLab credited the HackerOne user invisiblemeerkat with reporting the flaw.<\/p>\n

In February, GitLab fixed another gateway flaw<\/a>, CVE-2026-1868, which it also rated 9.9. A logged-in user could reach that flaw through a crafted flow definition, and it could lead to denial of service or code execution on the gateway.<\/p>\n

Both flaws are template engine weaknesses of the same class, CWE-1336. The new advisory does not mention the February flaw.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Swati Khandelwal\ue802Oct 02, 2026Vulnerability \/ Application Security A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under…<\/p>\n","protected":false},"author":1,"featured_media":3345,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[60,1223,58,13,70,1722,2717,57,2021,777],"class_list":["post-3344","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-allowing","tag-command","tag-critical","tag-execution","tag-flaw","tag-gateway","tag-gitlab","tag-patches","tag-selfhosted","tag-servers"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3344"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3344\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3345"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}