GitLab has released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1 to address CVE-2026-90970, which it rates critical with a CVSS score of 9.9. According to GitLab’s patch release notice, an authenticated user with Duo Agent Platform access could, under certain conditions, escape the prompt template sandbox through a specially crafted flow configuration and run arbitrary commands on the AI Gateway. The notice lists the affected range as all versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1.
Only organizations that run their own gateway need to act. GitLab says it has already deployed a fix to GitLab-hosted AI Gateways, so customers on GitLab.com, GitLab Dedicated and self-managed instances that use a GitLab-hosted gateway need to do nothing. GitLab says it contacted self-hosted gateway customers before publishing the notice and strongly recommends that they update immediately. The notice lists no workaround, and it does not say whether the flaw has been used in attacks.
The notice names fixed builds for three release lines only. A team running a self-hosted gateway on a line older than 19.2 has no listed fixed build, so it should ask GitLab for the supported upgrade path before assuming the issue does not apply to it.
Our read: the flaw sits where users write the instructions that an AI service later runs. Any service that executes user-authored templates deserves the same access review as one that executes user-authored code. Teams with a self-hosted gateway can start by listing which accounts hold Duo Agent Platform access and who can create custom flows. We have covered the same pattern in a web form that could hijack Salesforce’s AI agent and in our piece on AI coding agents posting internal screenshots publicly.
Source: GitLab, AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
