GitLab AI Gateway Critical Flaw: Your Questions Answered
GitLab patched CVE-2026-90970 in self-hosted AI Gateway deployments. Here is what it means if your developers use Duo features on servers you run yourself.
GitLab is telling customers who run their own AI Gateway for Duo features to patch immediately. If your developers use GitLab.com or GitLab’s hosted gateway, the picture is different. These are the questions that matter.
What is the AI Gateway?
It is the service that exposes AI-native GitLab Duo capabilities. GitLab runs a cloud gateway used by GitLab.com, Self-Managed, and Dedicated customers. Organizations can also self-host an AI Gateway through GitLab Duo Self-Hosted.
What is CVE-2026-90970?
GitLab describes an improper neutralization issue that, under certain conditions, let an authenticated user with Duo Agent Platform access escape the prompt-template sandbox through a crafted flow configuration and run arbitrary commands on the AI Gateway host.
Who must act?
Self-Hosted AI Gateway customers should upgrade. GitLab released 19.2.4, 19.3.2, and 19.4.1 with the critical fix and says it already contacted affected self-hosted customers. Customers using a GitLab-hosted AI Gateway are already protected and need no action for this CVE.
Is this the same as last month’s path-traversal bug?
No. Last month GitLab fixed CVE-2026-85706, a maximum-severity path traversal that could let unauthenticated attackers read sensitive files. CISA later added that flaw to its exploited catalog. CVE-2026-90970 is a separate AI Gateway remote code execution issue aimed at self-hosted gateway installs.
Why should non-developers care?
Source-control and AI tooling often hold tokens, deployment keys, and infrastructure secrets. A compromised gateway host is a shortcut into the build pipeline.
What this means for your company
- Inventory Duo and AI Gateway. Ask whether any self-hosted AI Gateway sits beside your GitLab instance.
- Patch self-hosted gateways now. Move to 19.2.4, 19.3.2, or 19.4.1 as GitLab directs.
- Limit who can define agent flows. Privileged AI features should not be open to every authenticated user by default.
Need help inventorying developer platforms and closing self-hosted AI exposure? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
Answers here are drawn from BleepingComputer’s report on GitLab’s AI Gateway advisory.
About The Author
