What Happened

GitLab disclosed a critical remote code execution vulnerability, CVE-2026-90970, with a CVSS score of 9.9, affecting self-hosted AI Gateways. The flaw allows authenticated users with Duo Agent Platform access to escape a prompt template sandbox and execute arbitrary commands on the gateway. GitLab released patches in versions 19.2.4, 19.3.2, and 19.4.1 on October 2, 2026, and a public proof of concept was released on October 3, 2026.

Who Is Affected

Only self-managed GitLab customers using the AI Gateway are affected. Customers using GitLab's hosted AI Gateway are not impacted and do not need to take action. GitLab has contacted affected customers with guidance prior to the public advisory.

Market Impact

This vulnerability creates an immediate patching requirement for thousands of self-hosted GitLab deployments. Security vendors should note:

• Urgent need for patch automation and vulnerability management tools to address the CVSS 9.9 flaw.
• Potential for exploitation given the public PoC, increasing demand for runtime security monitoring.
• Opportunity to engage GitLab self-managed customers with security solutions that detect sandbox escapes or command execution.

What to Watch

Monitor for active exploitation attempts targeting unpatched AI Gateways. Watch for additional advisories from GitLab and follow-up patches. Track customer response rates to patching recommendations as a signal for security tooling needs.

Related coverage

• Kritieke kwetsbaarheid in GitLab wordt actief misbruikt: update nu
• Critical FortiMail vulnerability CVE-2026-104286 actively exploited in zero-day attacks
• Citrix NetScaler Unpatched Pre-Auth RCE CVE-2026-88771 Actively Exploited
• Critical RCE Vulnerability CVE-2026-86950 in Apple iOS/macOS Under Active Exploitation