Published
- 4 min read
By Allan D - Editor, AI Security Wire
GitLab Patches CVSS 9.9 Sandbox Escape in AI Gateway
GitLab shipped a critical patch on October 2 for a flaw in its self-hosted AI Gateway, the component that routes requests from GitLab’s Duo Agent Platform to the underlying language models. CVE-2026-90970 carries a CVSS score of 9.9, and the mechanics behind it make clear why: an authenticated user with access to the Duo Agent Platform could craft a flow configuration that escapes the prompt template sandbox entirely and runs arbitrary commands on the Gateway host.
That’s a short jump from “user configures an agent workflow” to “user owns the server running it.” GitLab tracks the bug as CWE-1336, improper neutralization of special elements in a template engine, the same bug family that’s burned plenty of web frameworks over the years, just relocated into the plumbing of an AI agent product.
What the bug actually does
The Duo Agent Platform lets users define flows, configurable pipelines that chain prompts, tools, and model calls together to automate tasks inside GitLab. Those flows get rendered through a template engine before being sent to a model. GitLab builds a sandbox around that rendering step specifically so a flow author can’t reach outside the intended scope. CVE-2026-90970 is a hole in that sandbox: a specially crafted flow configuration lets the template engine execute code on the Gateway itself instead of just producing text for a prompt.
Because the AI Gateway handles requests across model providers and holds the credentials to reach them, researchers tracking the bug have flagged that a successful escape could expose things like model-provider API keys and signing material sitting on the Gateway host. GitLab hasn’t published proof-of-concept details, so the exact blast radius in a real exploit chain isn’t public.
Who’s affected
This one only bites self-managed deployments. Affected versions run 18.1.6 up through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0. Fixes landed in 19.2.4, 19.3.2, and 19.4.1. GitLab.com, GitLab Dedicated, and self-managed instances pointing at a GitLab-hosted Gateway were already covered before public disclosure, since GitLab patched its own infrastructure first. If you run the AI Gateway yourself, which is a separate deployable component from the core GitLab application, you need to pull the updated image or Helm chart directly. Bumping the main GitLab version alone won’t fix it.
The researcher who reported it, going by the handle invisiblemeerkat on HackerOne, found it through GitLab’s bug bounty program rather than anyone catching it in the wild. As of the most recent tracking, there’s no confirmed exploitation and the CVE isn’t in CISA’s Known Exploited Vulnerabilities catalog. No public exploit code has surfaced either.
Why this matters beyond GitLab
Sandbox escapes in template engines aren’t new, but doing it inside an AI agent pipeline changes the stakes. The whole pitch of products like Duo Agent Platform is letting users wire up multi-step automations without writing code, which means the configuration surface, the flows themselves, becomes an attack surface too. A low-privilege user who can create or edit a flow becomes a potential path to code execution on infrastructure that also talks to your model provider and may hold tokens for other systems.
Expect more of this pattern. As vendors rush agent platforms to market, the sandboxing around “untrusted config in, model call out” is going to get tested by researchers and attackers at the same rate the products ship. This isn’t prompt injection in the classic sense, nobody tricked the model into misbehaving, it’s a template engine failing to keep user input contained. But the result lands in the same bucket: an AI agent feature became the way in.
What to do now
If you operate a self-hosted AI Gateway, patch to 19.2.4, 19.3.2, or 19.4.1 depending on your track, and verify the deployed container tag rather than assuming an app-level upgrade covered it. Restrict who can create or edit Duo Agent Platform flows in the meantime, and review recent flow changes for anything unexpected. Guidance circulating alongside the advisory also recommends limiting the Gateway’s outbound network access to only the services it needs, which won’t stop the bug but shrinks what an attacker can reach if it’s triggered.
References
Frequently Asked Questions
- What is GitLab's Duo Agent Platform and why does this flaw matter?
- Duo Agent Platform is GitLab's feature for building automated, multi-step agent workflows (called flows) that chain prompts and tool calls together and route through GitLab's AI Gateway to reach a language model. Because the Gateway sits between those flows and the model provider, and holds credentials to reach it, a code execution bug there gives an attacker a foothold with access well beyond a single user's permissions.
- Is CVE-2026-90970 being exploited in the wild?
- No confirmed exploitation has been reported as of the most recent tracking. The flaw isn't listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept or exploit code has surfaced. GitLab disclosed it through its HackerOne bug bounty program rather than in response to an active attack.
- What should self-hosted GitLab AI Gateway operators do right now?
- Upgrade the AI Gateway to 19.2.4, 19.3.2, or 19.4.1 depending on your release track, and confirm it by checking the deployed container image or Helm chart directly, since the Gateway is versioned and deployed separately from the main GitLab application. Restrict who can create or edit Duo Agent Platform flows in the meantime and review recent flow configuration changes for anything unexpected.