CVE-2026-90970

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

No known exploitation. EPSS puts it in the 60th percentile. Fixed versions are out.

CVSS 3.19.9Critical EPSS percentile60th0.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product3 fixed builds listed below

Published 2026-10-02Updated 2026-10-02Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

GitLab AI GatewayAffected: ≥ 18.1.6, < 19.2.4Upgrade to: 19.2.4Affected: ≥ 19.3, < 19.3.2Upgrade to: 19.3.2Affected: ≥ 19.4, < 19.4.1Upgrade to: 19.4.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your GitLab instance runs the AI Gateway component and has Duo Agent Platform enabled.
Identify your current AI Gateway version (look for anything from 18.1.6 up to but below 19.2.4, 19.3.2, or 19.4.1).
Upgrade to GitLab AI Gateway 19.2.4, 19.3.2, or 19.4.1 (or newer), matching your release branch.
If you cannot upgrade immediately, restrict Duo Agent Platform access to only fully trusted users until the update is applied.
After upgrading, verify the running version matches the fixed release.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

GitLab released patches for a critical RCE vulnerability in its self-hosted AI Gateway that allowed authenticated users to escape prompt template sandboxes.
as reported · Oct 5, 2026·Хакер (xakep.ru) summary
Advisory coverage
as reported · Oct 2, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

In plain language

Written by AI from the record

A serious flaw in GitLab's AI Gateway could let a logged-in user with AI assistant access take over the server running it, so if you use GitLab's Duo AI features you should update now.

Improper sandboxing of the prompt template engine in GitLab AI Gateway (CWE-1336) allows an authenticated Duo Agent Platform user to craft a malicious flow configuration that escapes the sandbox and achieves arbitrary command execution on the AI Gateway host.

If you're affected

Full AI Gateway server takeover
Lateral access into internal network
Exposure of code and prompt data
Operational disruption from compromised AI service

What is it

GitLab's AI Gateway runs the AI assistant features (like Duo) that help write code. This flaw is like leaving a side door in that assistant's workshop — someone with legitimate but limited access to the AI tool could slip through a crafted configuration and end up controlling the whole server, not just the AI feature.

Who is affected

This matters to you if you self-host or operate a GitLab instance with the AI Gateway component and have Duo Agent Platform enabled for users. It does not require tricking an outside attacker in — anyone who already has an account with access to the AI agent features could exploit it.

How urgent is it

This is rated critical because a user with only AI Gateway access could escalate to full server command execution — a severe jump in privilege with no special skill required beyond having an account. There is no confirmed active exploitation or public exploit code yet, but the ease and severity of the flaw plus recent press attention mean it should be treated as a top-priority fix, not something to defer.

What to do — in detail

Confirm your deployment includes the AI Gateway service and that Duo Agent Platform is enabled — if neither applies, you are not affected. Determine the exact running version; vulnerable ranges are 18.1.6 up to (not including) 19.2.4 on the 19.2 branch, up to 19.3.2 on the 19.3 branch, and up to 19.4.1 on the 19.4 branch. Upgrade to the fixed version matching your branch (19.2.4, 19.3.2, or 19.4.1 or later); check release notes for breaking changes in the AI Gateway service before upgrading. As a temporary mitigation, limit Duo Agent Platform access to a minimal set of trusted accounts and audit flow configuration permissions until patched. No CISA KEV due date applies since this is not yet listed in KEV. Monitor GitLab security advisories and your AI Gateway logs for anomalous flow configuration changes or unexpected process execution post-upgrade.

Technical context

CVSS 3.1 score 9.9 (Critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network-exploitable, low complexity, requiring low privileges, no user interaction, with scope change and complete loss of confidentiality, integrity and availability. Weakness is CWE-1336 (improper neutralization in a template engine), enabling sandbox escape from the prompt template engine to arbitrary command execution. Not listed in CISA KEV; no public exploit code is known; EPSS places predicted exploitation likelihood in the 60th percentile with a flat trend. Exploit maturity is currently theoretical/PoC-absent, but the vulnerability requires only low-privilege authenticated access (Duo Agent Platform user) and no user interaction, making exploitation straightforward once an account is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 0 days, from the signal feeds we watch.

2026-10-02Patch availablepatch available, published, weakness classified, record updated, record updated

Affected products

GitLabcommercial · NLaka gitlab ce/ee
- GitLab AI GatewaySaaS ServiceSaaSDevTools & CI

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable