GitLab has released fixes for a critical vulnerability in its self-hosted AI Gateway that could let an authenticated user run arbitrary commands on the server, BleepingComputer reported Friday. The flaw, tracked as CVE-2026-90970, carries a CVSS score of 9.9, according to The Hacker News.

What Happened

The bug sits in how the gateway handles the prompt template of a custom flow in GitLab's Duo Agent Platform. A user with access to that platform could build a flow configuration that escapes the template sandbox and executes commands on an unpatched gateway. GitLab classifies it under CWE-1336, the category for improperly neutralized special elements in a template engine.

According to The Hacker News, affected releases are gateway versions 18.1.6 through 19.1.x, 19.2.0 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0. The fixed versions are 19.2.4, 19.3.2 and 19.4.1.

RelatedClaude Code Desktop Preview Flaw Could Have Exposed Developers’ Cloud Keys, Researchers Say

GitLab said gateways it hosts were already protected, so GitLab.com users and managed customers relying on those gateways do not need to do anything. It urged all self-managed customers running the self-hosted AI Gateway to move to a fixed release immediately, and said it had contacted those customers directly before publishing the update, according to BleepingComputer.

The flaw was reported through HackerOne by a researcher using the handle invisiblemeerkat, The Hacker News said. CISA's assessment listed exploitation as "none" as of Oct. 2, and neither outlet reported attacks.

Why It Matters

Organizations run their own AI Gateway to keep traffic between GitLab and AI models inside infrastructure they control. That same position makes the gateway a sensitive target. The Hacker News noted that self-hosted gateways store signing keys for JSON Web Tokens and connect both to GitLab instances and to external AI model providers. Command execution on such a server could give an attacker a foothold between a company's code repositories and the models its developers use.

The requirement for an authenticated account with Duo Agent Platform access narrows who can exploit the bug. But in large companies that roll agent features out widely, that can still mean many employees, contractors or compromised accounts.

A Recurring Weak Spot

The flaw is not the first of its kind in GitLab's agent tooling. In February, GitLab fixed CVE-2026-1868, another 9.9-rated template-engine bug that allowed code execution through crafted flow definitions, according to The Hacker News.

GitLab has also faced active exploitation recently. Last month it patched CVE-2026-85706, a maximum-severity path traversal flaw that CISA then added to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to fix it, BleepingComputer reported. CISA has flagged five GitLab vulnerabilities as exploited in the wild since November 2021.

What to Watch

Administrators should confirm which gateway version they run and upgrade to 19.2.4, 19.3.2 or 19.4.1. Watch for a public proof of concept, which would make the flaw easier to weaponize, and for any change in CISA's exploitation assessment. Last month's GitLab bug ended up in the KEV catalog; a similar listing for CVE-2026-90970 would signal that attacks have begun.