GitLab has issued an urgent advisory regarding a critical vulnerability affecting its AI Gateway service, which provides access to AI-powered GitLab Duo capabilities. The flaw poses a risk to organizations running self-hosted instances, though users of GitLab's cloud-based AI Gateway do not require immediate action.
The vulnerability, identified as CVE-2026-90970, stems from improper input neutralization that permits attackers holding basic privileges and Duo Agent Platform access to execute arbitrary code on unpatched systems. GitLab explained the issue in a Friday security notice: "GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway."
To remediate the flaw, GitLab has released patched versions 19.2.4, 19.3.2, and 19.4.1 for organizations operating their own AI Gateway infrastructure. Customers relying on GitLab's managed service are already protected and need not take any steps. The company stated: "These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately."
GitLab indicated it had already contacted affected self-hosted AI Gateway operators before the public disclosure and emphasized the importance of swift upgrades to mitigate exposure.
This disclosure arrives shortly after GitLab addressed another severe flaw last month. CVE-2026-85706, a path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition, allowed unauthenticated actors to access sensitive information including credentials and secrets. The U.S. Cybersecurity and Infrastructure Security Agency subsequently designated this flaw as actively exploited and mandated that federal agencies patch their systems within three days under Binding Operational Directive 26-04.
Since late 2021, CISA has documented five GitLab vulnerabilities being weaponized in active attacks, with at least one variant leveraged by ransomware operations. GitLab's DevSecOps platform serves over 30 million registered users and is deployed across more than half of Fortune 100 enterprises, including Nvidia, Lockheed Martin, T-Mobile, Goldman Sachs, Airbus, and UBS.