GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab has issued an urgent fix for a critical flaw in its AI Gateway component, which powers Duo AI features and can be run either as GitLab's own cloud service or self-hosted by customers. The bug, tracked as CVE-2026-90970, arises from improper input sanitization and allows a user with only basic access to the Duo Agent Platform to break out of the prompt template sandbox through a crafted flow configuration, ultimately executing arbitrary commands on the AI Gateway server. GitLab says instances it hosts itself are already protected, but anyone running a self-managed AI Gateway must upgrade immediately to version 19.2.4, 19.3.2, or 19.4.1, and the company notes it privately contacted affected self-hosted customers before going public with the advisory. There is no indication yet that this flaw has been exploited, but it follows a separate maximum-severity path traversal bug (CVE-2026-85706) in GitLab CE/EE that CISA recently confirmed was actively exploited and added to its known-exploited vulnerabilities list.