CVE-2026-90970: GitLab AI Gateway Escape
TL;DR - CVE-2026-90970 is a critical AI Gateway sandbox-escape vulnerability with a CVSS score of 9.9. - Authenticated users with Duo Agent Platform access may execute arbitrary commands through a crafted flow configuration. - Upgrade to 18.1.6, 19.2.4, 19.3.2, or 19.4.1, or a later supported release, and restrict access while patching.
CVE-2026-90970 is a critical GitLab AI Gateway vulnerability involving a sandbox escape in prompt-template processing. An authenticated user with access to GitLab Duo Agent Platform functionality may be able to execute arbitrary commands on the AI Gateway host through a crafted flow configuration.
Are You Affected?
CVE-2026-90970 affects GitLab AI Gateway deployments running vulnerable versions. Exploitation requires authentication and access to Duo Agent Platform functionality. The resulting impact can include arbitrary command execution on the AI Gateway host.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-90970 |
| CVSS | 9.9 Critical |
| Attack vector | Not exposed in the supplied NVD record; confirm the vector directly in NVD |
| Authentication | Required; the attacker must have Duo Agent Platform access |
| Privileges required | Authenticated access with the relevant Duo Agent Platform capability |
| Patch available | Yes |
| Affected component | GitLab AI Gateway |
| Impact | Arbitrary command execution on the AI Gateway |
The NVD description identifies affected releases as AI Gateway versions earlier than 18.1.6 in the 18.x line, 19.2.x versions before 19.2.4, 19.3.x versions before 19.3.2, and 19.4.x versions before 19.4.1. The NVD wording for the 18.x range is ambiguous, so administrators should verify the exact deployed version against GitLab remediation guidance rather than rely on an inferred boundary.
Prioritize systems that expose Duo Agent Platform to a broad user population, external users, or less-trusted internal groups. Include isolated and development AI Gateway instances in the inventory as well. These systems may retain credentials, network access, or deployment permissions that make command execution consequential.
Analyst’s Take: Treat this first as an AI Gateway host-compromise risk, not only as a flaw in prompt handling. Authentication is required, but environments that broadly grant Duo Agent Platform access should move those deployments to a fixed release and review the gateway’s credentials, permissions, and network reach.
The Fix, If You’re in a Hurry
Upgrade each AI Gateway deployment to the fixed release corresponding to its release line:
- 18.1.6 or later
- 19.2.4 or later
- 19.3.2 or later
- 19.4.1 or later
A later supported release is preferable where operationally appropriate. Verify the running version after deployment and confirm that all gateway replicas, workers, and secondary environments were updated. Updating the GitLab control plane alone may not remediate a separately deployed AI Gateway.
The supplied advisories do not identify a universal GitLab AI Gateway installation method or vendor-specific upgrade command. Do not invent a package or container name. Use the deployment manifest, Helm values, image policy, or release automation that controls your gateway. For a Kubernetes deployment, the operational pattern is:
# Replace the namespace, release, chart, and image setting with your deployment values.
helm upgrade <ai-gateway-release> <ai-gateway-chart> \
--namespace <namespace> \
--set image.tag=19.4.1
If the gateway is managed through a different mechanism, update its pinned artifact to the appropriate fixed version and roll all instances.
Until patching is complete:
- Restrict Duo Agent Platform access to trusted administrators.
- Disable affected flow-authoring functionality where feasible.
- Place the gateway behind network controls that limit outbound access.
- Limit access to sensitive internal services.
- Review the gateway’s service-account permissions and mounted secrets.
These measures reduce exposure but are not a substitute for upgrading.
How This Vulnerability Works
CVE-2026-90970 involves insufficient isolation or validation in the AI Gateway’s prompt-template sandbox. A user with the required authenticated Duo Agent Platform access can submit a specially crafted flow configuration. That configuration can escape the intended prompt-template execution boundary and cause attacker-controlled commands to run on the gateway.
The available NVD material does not identify the vulnerable function, parser, validation routine, or patch commit. It is therefore not possible to responsibly describe a specific payload syntax or claim that a particular template-language feature is the root cause. Defenders should treat the issue as a configuration-processing sandbox escape, not as a prompt-injection-only problem.
The key security boundary is the AI Gateway host. Successful command execution may expose environment variables, service credentials, cached data, local files, and network paths available to the gateway process. The ultimate impact depends on the gateway’s operating-system account, container permissions, mounted secrets, cloud identity, and egress controls.
Technical Notes
Correlate flow-configuration changes with process creation on the gateway host. Look for newly created or modified flow definitions followed shortly by shell, interpreter, package-manager, network utility, or unexpected child-process activity.
Severity, Explained
The CVSS base score is 9.9 Critical. The supplied NVD response included the score but did not expose the complete CVSS vector string. Administrators should retrieve the current NVD record and record the vector before using individual metric values in formal risk reports.
The practical severity comes from the combination of command execution and the gateway’s likely position between users, AI services, internal APIs, and credentials. Authentication lowers the pool of potential attackers compared with an unauthenticated flaw, but the required access is specifically tied to Duo Agent Platform functionality. Where that capability is widely available, the authentication requirement may provide limited protection.
CVE-2026-90970 should be treated as a high-priority remediation even though no confirmed exploitation was identified in the supplied sources. A command-execution flaw in an AI integration service can provide a foothold for credential theft, lateral movement, data access, or persistence if the service account and network placement are permissive.
For broader resilience planning, review your recovery controls and compare immutable backup providers before an AI gateway compromise affects connected systems.
Is It Being Exploited?
No confirmed in-the-wild exploitation was identified in the supplied NVD or CISA Known Exploited Vulnerabilities results. CVE-2026-90970 was not listed in the CISA KEV catalog at the time of review, and no ransomware campaign association was identified.
No relevant public proof-of-concept repository or exploit was identified in the supplied research. That status can change after publication, and the absence of a public PoC does not establish safety. The vulnerability description provides enough information for a capable attacker with authenticated access to investigate the flow-configuration boundary independently.
The relevant prerequisites are authenticated access and Duo Agent Platform access. Security teams should review which users, groups, service accounts, and integrations can create or modify flow configurations. Treat any unexpected configuration change followed by command execution or outbound network activity as a potential incident, regardless of current KEV or PoC status.
Detecting It in Your Environment
Start by inventorying every AI Gateway deployment, including standalone services, Kubernetes workloads, development environments, and replicas managed outside the primary GitLab platform. Record the running version, exposed interfaces, Duo Agent Platform configuration, service account, mounted secrets, and outbound network permissions.
Review audit and application logs for flow creation or modification by unusual users, unusual source addresses, malformed or unexpectedly large configuration submissions, and activity immediately followed by process creation. Log field names vary by deployment, so the following search is intentionally broad and should be adapted to your logging format:
grep -Eai \
'flow|prompt[-_ ]template|duo|agent|config(uration)?.*(creat|modif|update)|child process|exec|spawn|command' \
/var/log/ai-gateway/*.log
On centralized logging platforms, correlate events rather than searching for one definitive signature. A useful detection sequence is:
1. Authenticated user accesses Duo Agent Platform
2. User creates or modifies a flow configuration
3. AI Gateway process spawns a shell, interpreter, or unexpected executable
4. Gateway initiates a new outbound connection or reads sensitive files
Example fields to correlate include user, source.ip, flow_id, configuration_id, timestamp, process.parent, process.command_line, destination.ip, and destination.port. These names are illustrative because the supplied references do not define GitLab’s exact log schema. Preserve the original configuration and process telemetry before cleanup if suspicious activity is found.
For endpoint triage after a suspected gateway compromise, an organization’s existing security tooling may help identify unexpected processes and persistence. Use Get Bitdefender → only where it fits your organization’s approved security workflow; it is not a substitute for patching, containment, or forensic investigation.
Technical Notes
On Linux hosts, inspect recent child processes owned by the gateway service account and compare them with the expected process tree:
ps -eo user,pid,ppid,lstart,args --forest | \
grep -Eai 'ai-gateway|python|node|sh|bash|curl|wget|nc|socat'
This is not a vulnerability-specific signature. It is a triage technique for identifying unexpected execution near the gateway process. Containerized deployments should also review container runtime events, Kubernetes audit logs, pod exec activity, and egress flow logs.
Incident Response and Recovery
If suspicious command execution is identified:
- Isolate the affected AI Gateway from unnecessary network access.
- Preserve flow configurations, audit logs, process data, and container or host telemetry.
- Identify the users and integrations that could create or modify flows.
- Review credentials, tokens, cloud identities, and secrets available to the gateway.
- Rotate exposed credentials from a clean administrative environment.
- Rebuild or redeploy the gateway from a trusted, fixed artifact.
- Review related GitLab, cloud, identity, and endpoint activity for lateral movement.
- Confirm that all gateway replicas and secondary environments are patched.
Do not assume that restarting the gateway removes attacker access or persistence. If the gateway host or container had access to secrets, investigate those secrets even when logs do not confirm data theft.
References and Further Reading
The primary technical record is the NVD entry for CVE-2026-90970. Use it to confirm the current affected-version language, CVSS vector, and any later updates to the vulnerability record.
GitLab’s related work item is available at GitLab work item 628842. Review GitLab’s release and security documentation for deployment-specific remediation instructions and implementation details that are not present in the NVD summary.
For exploitation tracking, consult the CISA Known Exploited Vulnerabilities catalog. Its current absence of CVE-2026-90970 means there is no CISA listing confirming known exploitation at the time of review; it does not prove that exploitation has not occurred.
Document the gateway version before and after remediation, preserve relevant audit logs, and reassess exposed credentials if suspicious command execution is found. If compromise is suspected, isolate the gateway, rotate credentials available to its process, review outbound connections, and investigate related GitLab and cloud activity.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.