В GitLab AI Gateway исправили критический баг на 9,9 балла

GitLab has released fixes for a critical flaw, tracked as CVE-2026-90970 and rated 9.9 on the CVSS scale, in its AI Gateway component. The bug lets an authenticated attacker who has access to the Duo Agent Platform craft a special flow configuration that breaks out of the prompt-template sandbox, ultimately allowing arbitrary command execution on the AI Gateway server. Only self-hosted AI Gateway deployments are affected, starting from version 18.1.6 through 19.1.x; GitLab's own cloud-hosted instance used for GitLab.com, GitLab Self-Managed and GitLab Dedicated is already protected and requires no customer action. Fixes are included in versions 19.2.4, 19.3.2 and 19.4.1, and since AI Gateway is deployed separately as a Docker image or Helm chart, administrators must update it independently of GitLab itself; GitLab urges affected customers to patch immediately given that the gateway stores JWT signing keys and interfaces with both the GitLab instance and organizations' AI model providers.