Configure a flow, run a command

On 2 October 2026 GitLab published CVE-2026-90970 and a dedicated patch release for its AI Gateway, sent out apart from its usual Community and Enterprise Edition releases. The advisory carries a single fix, titled "Improper Neutralization issue in custom flow prompt template impacts AI Gateway", rated Critical.

The vulnerable element is the prompt template of a custom flow on the Duo Agent Platform, the service that lets users assemble multi-step agent workflows. An authenticated user with Duo Agent Platform access could supply a specially crafted flow configuration that escaped the prompt template sandbox and reached arbitrary command execution on the gateway. GitLab classifies the weakness as CWE-1336, improper neutralization of special elements used in a template engine, and rates it 9.9 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Only organizations that run their own gateway need to move. GitLab already patched the gateways it hosts, so customers on GitLab.com, GitLab Dedicated, and self-managed instances using a GitLab-hosted gateway need no action. GitLab said it contacted self-hosted customers with the guidance before it published the advisory.

The fixed gateway versions are 19.2.4, 19.3.2 and 19.4.1. Affected are AI Gateway 18.1.6 up to but excluding 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. The gateway is deployed as its own Docker image or Helm chart and updates on its own schedule, so it is not covered by a GitLab application upgrade. Older release lines are left without a fixed gateway: the affected range opens at 18.1.6, and the lowest fixed version is 19.2.4, so gateways on 19.1 or earlier may need the GitLab instance itself moved forward first. GitLab's advisory does not address that case, and the low-level conditions that trigger the escape are not listed.

The AI Gateway is the service that connects a GitLab instance to AI models, and in a self-hosted deployment the customer runs it as a container beside their own instance and model endpoints. It holds the JWT signing keys GitLab's install guide says must be treated as sensitive credentials, and it holds the connections to the organization's model providers. A flaw that turns a user's flow configuration into commands on that service moves the boundary from "can use the agents" to "can run code on the infrastructure".

This is a template sandbox escape rather than prompt injection against a model. The advisory describes a chain that runs from the user's flow configuration through the template engine to command execution; the model's output appears nowhere in it. The work item linked from the CVE record is not public; GitLab makes security issues public on its tracker 90 days after release.

OpenCVE's auto-generated guidance for operators who cannot update immediately is to restrict Duo Agent Platform access to trusted administrators, review existing flow configurations, and test sandbox isolation. GitLab itself offers no vulnerability-specific workaround, only the update.

There is no known exploitation in the wild. The EPSS estimate is below 1 percent, CISA's SSVC assessment is "Exploitation: none", and the CVE is not in the KEV catalog. GitLab has not said whether 18.1.6 introduced the vulnerable code or is simply the oldest release it checked.

The CVE record credits the HackerOne researcher invisiblemeerkat. The same class of flaw hit the same component in February 2026, when CVE-2026-1868 covered insecure template expansion in the AI Gateway's Duo Workflow Service and carried the identical 9.9 vector; that fix went out in gateway versions 18.6.2, 18.7.1 and 18.8.1. The October issue is a different, later component range, but it is the second time a user-supplied flow definition has been the thing that reached the host.