GitLab patched a critical sandbox escape in its self-hosted AI Gateway
What happened
GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let a signed-in user with Duo Agent Platform access escape the prompt template sandbox through a crafted flow configuration and run commands on the AI Gateway. Only self-hosted gateways needed to upgrade. No exploitation was reported.
The flaw affected GitLab AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2 and 19.4 before 19.4.1. An authenticated user with access to the Duo Agent Platform could break out of the prompt template sandbox with a specially crafted flow configuration and, under certain conditions, run arbitrary commands on the gateway. The reported discoverer was a HackerOne researcher.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
The software involved works with many AI models, so no single model maker was involved. The product was GitLab AI Gateway, a type of work assistant. Vulnerability IDs: CVE-2026-90970.
Impact
Data was exposed. Data involved: unknown. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm. This was a research finding: no real victims are known.
It became public on 2 Oct 2026.
GitLab released fixes in 19.2.4, 19.3.2 and 19.4.1 and had already deployed the fix for GitLab-hosted gateways, including GitLab.com and GitLab Dedicated, so only self-hosted installations had to upgrade.