GitLab has released urgent security updates for its AI Gateway component to address a critical vulnerability, tracked as CVE-2026-90970. The flaw, which carries a CVSS score of 9.9, allows an authenticated user with access to the Duo Agent Platform to execute arbitrary commands remotely on the server.
The issue stems from improper handling of user-provided prompt templates. By submitting a specially crafted configuration, an attacker can bypass the isolated template processing environment. While the attack requires an existing account with specific permissions, it does not necessitate any further interaction from other users.
The vulnerability affects self-managed instances running versions from 18.1.6 up to 19.4.1. GitLab has patched the flaw in versions 19.2.4, 19.3.2, and 19.4.1. Administrators are advised to verify the specific version of the AI Gateway component, as it may differ from the main GitLab installation.
GitLab confirmed that its own hosted services, including GitLab.com and GitLab Dedicated, are already secured. The vulnerability was discovered by a researcher known as invisiblemeerkat. At this time, the company has not reported any evidence of active exploitation in the wild.
