On October 2, 2026, GitLab released a fix for CVE-2026-90970, a critical remote code execution vulnerability in AI Gateway. The scenario described by the vendor depends on specific access conditions; it is not an anonymous flaw affecting every GitLab deployment.
Scope: self-hosted AI Gateway
The advisory affects AI Gateway from version 18.1.6 up to the fixed versions 19.2.4, 19.3.2, and 19.4.1 on their respective branches. A crafted prompt template can escape the sandbox under a flow requiring an authenticated user with Duo Agent Platform access, enabling code execution on the gateway host. GitLab instances without the service or relevant access are not automatically exposed.
Fixed versions
GitLab lists AI Gateway 19.2.4, 19.3.2, and 19.4.1 as fixes for the corresponding branches. Use the official advisory to identify your branch version and update promptly. GitLab says its hosted AI Gateway service had already been fixed.
Prioritize gateway hosts
Inventory self-hosted AI Gateway deployments, their versions, and accounts with Duo Agent Platform access. Remove unnecessary permissions and restrict network access to hosts. Updating does not replace log review if an instance was exposed while vulnerable.
Checks after updating
Confirm the fixed version is running, old images and pods have been replaced, and logs show no unexpected activity. If suspicious access is found, isolate the gateway, preserve evidence, and rotate secrets available on that host.
How Soclyde fits
Gateway admin tokens and deployment credentials grant access to sensitive systems. Soclyde can help protect them and share them with authorized administrators; it does not patch vulnerable versions. See our password management guide and contact us.
What to remember
Identify self-hosted instances from 18.1.6 and earlier than 19.2.4, 19.3.2, or 19.4.1 on their respective branches, update them, and review logs for accounts with Duo Agent Platform access. For credential controls, see our password management guide.
