GitLab warns of critical RCE vulnerability in AI Gateway service
GitLab patches critical RCE in AI Gateway allowing arbitrary command execution
GitLab disclosed CVE-2026-90970, a critical remote code execution vulnerability in its AI Gateway service that allows authenticated users with Duo Agent Platform access to escape the prompt template sandbox and execute arbitrary commands. The flaw affects self-hosted AI Gateway deployments; GitLab released patched versions 19.2.4, 19.3.2, and 19.4.1, while cloud-hosted instances are already protected. This follows GitLab's recent patching of CVE-2026-85706, a maximum severity path traversal flaw that CISA added to its actively exploited vulnerabilities list.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitLab?
Get an email when a new story names GitLab, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical remote code execution vulnerability (CVE-2026-90970) in GitLab's AI Gateway service allows authenticated users to break out of a prompt template sandbox and execute arbitrary commands on self-hosted deployments — a severe risk given that authenticated access can still lead to full system compromise. This matters because AI-integrated services are rapidly expanding the attack surface of development platforms, and sandbox escapes in AI components represent an emerging and underappreciated threat vector. The fact that a second maximum-severity vulnerability (CVE-2026-85706) was simultaneously added to CISA's actively exploited list underscores that GitLab environments are under active threat. Self-hosted deployments are particularly exposed because they lack the automatic protections that cloud-hosted instances receive, placing the remediation burden entirely on operators.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-90970
- cve — CVE-2026-85706