GitLab AI Gateway
A component of GitLab that sits between the development platform and model providers, responsible for holding model credentials and terminating inference requests. It supports self-hosted and hybrid deployment models.
Timeline (last 90 days)
The CVE-2026-90970 vulnerability exists in the GitLab AI Gateway component and allows authenticated users with access to the Duo Agent Platform to escape the prompt template sandbox via a specially crafted workflow configuration, thereby executing arbitrary commands on the AI Gateway.
The affected AI Gateway version ranges are 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and starting from 19.4.0.
The GitLab-hosted AI Gateway was patched before the release notes were published, so no action is required for GitLab.com, GitLab Dedicated, or self-managed instances that use the GitLab-hosted AI Gateway.
The true risk exposure is concentrated among self-managed customers who run their own self-hosted gateway.
Upgrading the GitLab application itself does not necessarily update the AI Gateway, as the two have separate, independent release tracks.
In self-hosted deployments, the AI Gateway controls the entire inference path, and no prompts, code inputs, or model responses leave the customer's network.
If it cannot be confirmed that the upgrade was applied in time, any provider credentials held by the gateway should be rotated, gateway logs should be brought under monitoring, and version checks should be added to monthly asset inventory reports.
All Facts (7)
The CVE-2026-90970 vulnerability exists in the GitLab AI Gateway component and allows authenticated users with access to the Duo Agent Platform to escape the prompt template sandbox via a specially crafted workflow configuration, thereby executing arbitrary commands on the AI Gateway.
50%UnverifiedThe affected AI Gateway version ranges are 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and starting from 19.4.0.
50%UnverifiedThe GitLab-hosted AI Gateway was patched before the release notes were published, so no action is required for GitLab.com, GitLab Dedicated, or self-managed instances that use the GitLab-hosted AI Gateway.
50%UnverifiedThe true risk exposure is concentrated among self-managed customers who run their own self-hosted gateway.
50%UnverifiedUpgrading the GitLab application itself does not necessarily update the AI Gateway, as the two have separate, independent release tracks.
50%UnverifiedIn self-hosted deployments, the AI Gateway controls the entire inference path, and no prompts, code inputs, or model responses leave the customer's network.
50%UnverifiedIf it cannot be confirmed that the upgrade was applied in time, any provider credentials held by the gateway should be rotated, gateway logs should be brought under monitoring, and version checks should be added to monthly asset inventory reports.
50%