Security & FraudNews date: Published by Svertok:
GitLab urges immediate updates for critical self-hosted AI Gateway flaw
A crafted flow configuration could let an authenticated Duo Agent Platform user escape a prompt-template sandbox and execute commands on the gateway. GitLab rates the issue CVSS 9.9.
GitLab says it has fixed a critical AI Gateway vulnerability and is urging customers with affected self-hosted installations to update immediately. Its notice describes the remediation as complete but does not state when it was completed. Tracked as CVE-2026-90970 and rated CVSS 9.9, the flaw could have allowed an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway under certain conditions.
How the flaw could cross the security boundary
The issue involved improper handling of a custom-flow prompt template. GitLab says a user could submit a specially crafted flow configuration that escaped the prompt-template sandbox—the isolated environment intended to contain that template—and reached command execution on the AI Gateway. The notice describes this as a potential outcome and does not identify an observed command-execution incident.
Which installations require action
GitLab identifies three affected version ranges and separates them from services it hosts:
- Affected self-hosted versions are all releases from 18.1.6 up to, but not including, 19.2.4; releases in the 19.3 line before 19.3.2; and releases in the 19.4 line before 19.4.1.
- GitLab.com, GitLab Dedicated and GitLab Self-Managed instances that use a GitLab-hosted AI Gateway are already protected and require no action.
GitLab says it contacted self-hosted AI Gateway customers before publishing the release notice. For administrators updating an affected installation, the company points to its GitLab Self-Hosted AI Gateway installation documentation.
Next
CISA flags a Citrix NetScaler memory-buffer flaw as actively exploited
CVE-2026-88779 has entered the Known Exploited Vulnerabilities catalog, raising its remediation priority while leaving the attackers and campaign scale unidentified.
Read next
CISA Flags a FortiMail Path-Traversal Flaw as Actively Exploited
CVE-2026-104286 is now in the federal exploited-vulnerability catalog, raising its remediation priority while the short alert does not provide affected versions or attack details.
Read
Microsoft Centers Its Ignite 2026 Security Program on AI Agents
The November program will examine the identities, data and cloud resources that AI agents can access while previewing Microsoft's security roadmap.
Read