GitLab patches critical 9.9 AI Gateway template-sandbox-escape RCE (CVE-2026-90970)

What it is

CVE-2026-90970 affects GitLab's self-hosted AI Gateway (the Docker/Helm-deployed service connecting GitLab to AI models for Duo Agent Platform). CVSS 9.9, disclosed October 2, 2026.

How it works

A logged-in user with Duo Agent Platform access can craft a custom flow configuration (a user-created multi-step AI workflow) whose prompt template escapes the sandbox, leading to arbitrary command execution on the gateway itself. No specific attack conditions or required role beyond Duo Agent Platform access are described. This is the same bug class (CWE-1336, template engine weakness) as February's CVE-2026-1868, also rated 9.9, which GitLab fixed in its gateway — the new advisory doesn't reference that earlier flaw.

Preconditions / Affected

• Only self-managed organizations running their own AI Gateway are exposed — GitLab.com, GitLab Dedicated, and self-managed instances using a GitLab-hosted gateway are unaffected.
• Affected gateway versions: 18.1.6 through the entire 19.1 line. No fixed version exists below 19.2.4, so any gateway predating that is vulnerable with no patch path other than upgrading to a fixed line.
• A compromised gateway exposes JWT signing keys (explicitly flagged as sensitive credentials in GitLab's install guide), plus its connections to the GitLab instance and AI model providers.

What to do

Update to 19.2.4, 19.3.2, or 19.4.1. For Docker deployments:

docker stop <container>
docker rm <container>
docker pull <new-image-tag>   # e.g. self-hosted-v19.4.1-ee
docker run ...

For Helm deployments, set the new tag in the chart's image setting. GitLab notified self-hosted-gateway customers directly before publishing. No workaround is offered for gateways that can't be updated immediately.

Caveats

• CISA's CVE record assessment lists exploitation status as "none" as of October 2 (no public PoC, no active exploitation reported).
• The advisory doesn't state whether a 19.2.4+ gateway is compatible with GitLab instances still on 19.1 or earlier, nor whether older lines will get backported fixes — only 19.2, 19.3, and 19.4 currently receive security fixes under GitLab's maintenance policy.
• No method is given to determine whether a gateway was exploited before patching.