Unverified50% confidenceFactExact time
The CVE-2026-90970 vulnerability exists in the GitLab AI Gateway component and allows authenticated users with access to the Duo Agent Platform to escape the prompt template sandbox via a specially crafted workflow configuration, thereby executing arbitrary commands on the AI Gateway.
1
Sources
50%
Confidence
Long-term
Relevance
10/11/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedNormal Security披露的GitLost研究指出，当AI编程代理能访问多个仓库时，一条公开issue可能成为数据泄露入口72% similarUnverified现有AI聚合平台的中间人代理架构决定了端对端加密（E2EE）在技术上无法实现71% similarUnverified据GitHub的研究数据，AI生成的代码在安全漏洞密度上显著高于人工编写代码，主要集中在SQL注入、越权访问等漏洞类型69% similarUnverifiedIn the demonstration, the AI decoded Base64 to recover the Behinder backdoor's connection password as "admin".69% similarUnverifiedThe entry point of the JadePuffer attack is an unauthorized code execution vulnerability in Langflow, which allows arbitrary code to be executed on the target server without authentication.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/996906API
curl https://kongchang.com/api/v1/knowledge/claims/996906MCP
get_claim(id=996906)