GitLab AI Gateway

GitLab has fixed a critical vulnerability, tracked as CVE-2026-90970, affecting its AI Gateway component. Security outlets are urging users to update their deployments promptly, as flaws in AI gateway infrastructure could expose sensitive data or allow unauthorized access. Administrators are advised to review the advisory and apply the patch as soon as possible.

GitLab has disclosed CVE-2026-90970, a critical remote code execution vulnerability in its AI Gateway service. The flaw allows authenticated users with Duo Agent Platform access to escape the prompt sandbox and execute arbitrary commands. Self-hosted instances are affected, and security teams are being urged to patch promptly.

GitLab has patched a critical vulnerability, CVE-2026-90970, rated CVSS 9.9, in its AI Gateway. The flaw allows an authenticated attacker to escape the prompt-template sandbox and execute arbitrary commands on self-hosted deployments. Security professionals are urging administrators to apply the update quickly and check whether their installations are affected.

GitLab has released emergency security patches addressing two critical vulnerabilities: a remote code execution flaw in its AI Gateway, tracked as CVE-2026-90970, and a maximum-severity path traversal issue. Both flaws are reportedly being actively exploited, prompting the unusually urgent rollout. Security teams are being urged to apply the updates immediately, with the disclosures fueling renewed discussion about securing AI infrastructure.