What GitLab disclosed
GitLab fixed a critical vulnerability in its AI Gateway service, tracked as CVE-2026-90970. BleepingComputer reported on October 2, 2026, that the flaw could allow arbitrary command execution on vulnerable instances. GitLab’s patch notice describes an improper-neutralization issue involving a custom flow prompt template. Under certain conditions, an authenticated user with Duo Agent Platform access could escape the prompt-template sandbox through a specially crafted flow configuration and execute arbitrary commands on the AI Gateway. GitLab rated the issue critical, with a CVSS 3.1 score of 9.9. BleepingComputer, October 2, 2026; GitLab AI Gateway critical patch release
The advisory’s description matters for understanding the stated threat conditions: the route involves an authenticated user who has Duo Agent Platform access and a specially crafted flow configuration. The possibility of command execution makes this more than a prompt-output or data-display issue: the reported impact is execution on the gateway itself. The advisory does not say that every user can exploit the flaw, nor does it establish that exploitation has occurred. It describes what could happen under certain conditions. GitLab AI Gateway critical patch release
Which versions are affected and fixed
GitLab lists the following affected AI Gateway release ranges: all versions from 18.1.6 up to, but not including, 19.2.4; versions in the 19.3 line before 19.3.2; and versions in the 19.4 line before 19.4.1. The corresponding patched releases are 19.2.4, 19.3.2, and 19.4.1. Operators should compare the version actually running in their deployment with the affected ranges and select the patched release on the applicable line. GitLab AI Gateway critical patch release
These are AI Gateway versions, not a blanket statement that every GitLab installation is vulnerable. The scope and remedy depend on whether an organization runs the self-hosted gateway and, if so, which gateway release it operates. The patch notice specifically urges customers with GitLab Self-Hosted AI Gateway installations on affected versions to upgrade immediately to one of the listed fixed versions. GitLab AI Gateway critical patch release
Who needs to take action
The distinction between hosted and self-hosted service is central. GitLab says it has already deployed a fix for GitLab-hosted AI Gateways. Customers using GitLab.com, GitLab Dedicated, and GitLab Self-Managed instances that use a GitLab-hosted AI Gateway are protected and do not need to take action for this issue. By contrast, customers operating GitLab Self-Hosted AI Gateway installations should check their gateway version and upgrade affected installations to 19.2.4, 19.3.2, or 19.4.1, as applicable. GitLab AI Gateway critical patch release
This means the GitLab platform deployment model alone is not enough to determine exposure: a Self-Managed GitLab instance using GitLab-hosted AI Gateway is in the protected group described by GitLab, while a separately operated Self-Hosted AI Gateway installation falls within the group directed to upgrade if its version is affected. Confirm the gateway deployment type and its own version rather than assuming that the GitLab instance version answers both questions. GitLab AI Gateway critical patch release
A concise response plan
- Identify the gateway deployment. Establish whether your organization uses GitLab-hosted AI Gateway or operates a GitLab Self-Hosted AI Gateway. GitLab says the hosted service has been fixed; self-hosted operators are the audience for the upgrade recommendation. GitLab AI Gateway critical patch release
- Check the self-hosted gateway’s release. Compare it with GitLab’s affected ranges: 18.1.6 and later before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. GitLab AI Gateway critical patch release
- Upgrade an affected installation. GitLab recommends moving to 19.2.4, 19.3.2, or 19.4.1 as soon as possible, choosing the fixed release that corresponds to the applicable release line. Follow the Self-Hosted AI Gateway installation documentation for the update procedure. GitLab AI Gateway critical patch release
- Track future patch notices. GitLab’s release notice points customers to its patch-release RSS feed and its all-releases RSS feed for notifications. GitLab AI Gateway critical patch release
The available advisory gives the affected version ranges, fixed versions, exploitation prerequisites, and upgrade instruction. It does not provide a basis for claiming that a particular customer has been attacked, or that every affected instance was exposed in the same way. Treat version remediation as the immediate action, and use the organization’s normal incident-response process if independent evidence of compromise exists; the latter is general operational prudence, not a claim made in GitLab’s notice. GitLab AI Gateway critical patch release
Why the flaw is rated critical
GitLab’s CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, corresponding to a 9.9 score. In the vector, the published ratings indicate a network attack path, low attack complexity, low privileges required, and no user interaction; the impact ratings are high for confidentiality, integrity, and availability, with changed scope. This is the severity assessment published by GitLab, not a guarantee that exploitation is automatic or that every deployment meets the required conditions. The same advisory narrows the described path to an authenticated user with Duo Agent Platform access and a specially crafted flow configuration. GitLab AI Gateway critical patch release
The practical security concern is that a sandbox intended to constrain custom flow prompt templates could, in the stated circumstances, be escaped, leading to command execution on the gateway. That places the gateway runtime and its accessible resources in focus for operators assessing the risk. The source does not enumerate what resources a particular gateway can access, so organizations should assess their own deployment rather than infer a specific downstream compromise from the advisory alone. GitLab AI Gateway critical patch release
The practical takeaway
For customers using GitLab-hosted AI Gateway, GitLab says the fix is already deployed and no customer action is required for this vulnerability. Operators of GitLab Self-Hosted AI Gateway should verify the gateway version against the advisory and promptly upgrade affected versions to 19.2.4, 19.3.2, or 19.4.1 as applicable. Those concise steps reflect GitLab’s stated scope and recommendation; there is no need to repeat them as a separate, competing checklist. GitLab AI Gateway critical patch release
BleepingComputer’s report characterizes the warning as an urgent patch notice, while GitLab’s release documentation is the primary reference for the technical conditions, affected ranges, fixed releases, and hosted-service status. GitLab credited researcher invisiblemeerkat with responsibly disclosing the issue. BleepingComputer; GitLab AI Gateway critical patch release
