Critical Remote Code Execution in GitLab AI Gateway (CVE‑2026‑90970) Threatens Self‑Hosted Deployments
What It Is — GitLab disclosed a critical vulnerability (CVE‑2026‑90970) in its AI Gateway that allows an authenticated user with Duo Agent Platform access to break out of the prompt‑template sandbox and execute arbitrary commands on the host. The flaw scores 9.9 CVSS.
Exploitability — The vulnerability requires a valid Duo‑authenticated session and a crafted flow configuration; no public exploit code is known, but the high CVSS indicates a realistic risk for unpatched self‑hosted gateways.
Affected Products — GitLab AI Gateway versions 18.1.6‑19.2.3, 19.3.0‑19.3.1 (self‑hosted deployments). Cloud‑hosted GitLab.com, Dedicated, and managed gateways are already patched.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that sandboxing and input‑validation controls remain effective after code changes.
- Highlights the importance of maintaining up‑to‑date evidence of patch status for any self‑managed component that processes sensitive code or data.
- Provides a concrete test of the “application security and isolation” control objective that underpins multiple frameworks (e.g., NIST AI RMF, ISO 42001).
Recommended Actions
- Identify all self‑hosted GitLab AI Gateway instances and verify they run version 19.2.4 or later (or the corresponding 19.3.2/19.4.1 patches).
- Update inventory and configuration‑management records to capture the patch as evidence of control remediation.
- Review and harden prompt‑template handling logic; enforce least‑privilege permissions for Duo Agent users.
- Enable logging of gateway command execution and monitor for anomalous activity.