GitLab's AI Gateway RCE (CVSS 9.9) shows pipeline flow configuration is attacker-reachable code, not trusted infrastructure.
GitLab disclosed and patched CVE-2026-90970 on October 2, 2026: a CVSS 9.9 remote code execution flaw in the self-hosted GitLab AI Gateway, the component that sits behind GitLab Duo Agent Platform. An authenticated user with Duo Agent Platform access could craft a malicious flow configuration, the document that defines an automated AI review or coding pipeline, to escape the prompt template sandbox and run arbitrary commands on the gateway host. The number is high because the access path was low: no user interaction, low complexity, and a scope change that let a template rendering step reach past its sandbox into the host operating system.
Sources: OpenCVE: CVE-2026-90970 record (MITRE/NVD), BleepingComputer: GitLab Warns of Critical RCE Vulnerability in AI Gateway Service
The vulnerability affects self-hosted AI Gateway deployments running versions 18.1.6 before 19.2.4, 19.3.0 before 19.3.2, and 19.4.0 before 19.4.1. GitLab shipped fixes in 19.2.4, 19.3.2, and 19.4.1, and had already rolled the fix out to GitLab.com, GitLab Dedicated, and self-managed instances that point at a GitLab-hosted gateway, so none of them needed to act. Only organizations running their own AI Gateway image were exposed. The gateway is versioned separately from core GitLab, so upgrading the main GitLab instance does not fix this on its own. Operators have to update the gateway image directly.
Sources: OpenCVE: CVE-2026-90970 record (MITRE/NVD), Security Affairs: CVE-2026-90970, Critical GitLab AI Gateway Flaw Fixed
What CWE-1336 actually describes
GitLab classified the flaw as CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine, with a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Translated out of the scoring shorthand: reachable over the network, low attack complexity, only low privileges required, no user interaction needed, and a scope change, meaning the attacker's template rendering crosses the boundary it was supposed to stay inside and reaches the host, with high impact to confidentiality, integrity, and availability once it does. The researcher who reported it, credited on HackerOne under the handle invisiblemeerkat, disclosed it responsibly rather than publishing exploit code. As of disclosure, both the CVE record and CISA's assessment list exploitation status as none observed, and no public proof of concept has surfaced since.
Sources: OpenCVE: CVE-2026-90970 record (MITRE/NVD), The Hacker News: GitLab Patches Critical Self-Hosted AI Gateway Flaw
A template sandbox escape, in plain terms
GitLab's advisory describes the flaw as an escape from a "prompt template sandbox" inside the AI Gateway, without naming which template engine sits behind it, and no independent technical writeup has filled in that detail either. Treat the specific engine as unconfirmed. What is confirmed is the weakness class: CWE-1336 exists for exactly this situation, where a template string comes from someone other than the engineer who wrote the surrounding application. A sandboxed template engine is supposed to block a template from reaching dangerous object attributes, built-in functions, or the interpreter underneath it. A sandbox escape means a crafted template string gets past those blocks anyway, typically by walking an object's own attribute chain until it reaches something the sandbox's blocklist did not anticipate, and using that path to call out to the operating system directly.
Sources: BleepingComputer: GitLab Warns of Critical RCE Vulnerability in AI Gateway Service, The Hacker News: GitLab Patches Critical Self-Hosted AI Gateway Flaw
That mechanism is why calling the vulnerable artifact a "configuration" undersells what it actually is. A flow in Duo Agent Platform is not a YAML file listing steps in the abstract. It gets compiled and rendered, because the entire purpose of a flow is to assemble a prompt dynamically out of user input, repository content, and tool output before that prompt goes to a model. The moment a configuration format includes template logic powerful enough to do that assembly, it stops being a static setting. It becomes a small program, written in a templating language, executing with the privileges of whatever service renders it. CWE-1336 exists as its own weakness category precisely because template engines keep getting treated as string formatters when they function as programming languages with their own injection surface.
It also helps to separate this from a more familiar risk it resembles on the surface. Prompt injection is about manipulating what a model does with text it has already been handed, after a well-formed prompt reaches it. CVE-2026-90970 fires a step earlier than that: the malicious payload executes inside the AI Gateway's own template engine, on the gateway's own server, while the prompt is still being assembled, before any model sees a single token. That is why GitLab classified it as remote code execution rather than a model-behavior problem, and why hardening a model's instructions or adding output filtering would do nothing against it. The vulnerability sits in the infrastructure that builds the prompt, not in the prompt itself, which is exactly the layer most AI security checklists do not cover yet.
Sources: BleepingComputer: GitLab Warns of Critical RCE Vulnerability in AI Gateway Service
The attack surface was the pipeline definition, not the app
This is the detail that separates CVE-2026-90970 from an ordinary application bug. The flaw did not live in a feature GitLab shipped to end users in the normal sense. It lived in the boundary around a format that customers themselves author. A flow is the artifact a team writes to define what its automated review or coding pipeline does: which prompts run, in what order, against which inputs. Any organization using Duo Agent Platform to automate review work was, by definition, giving some set of its own users the ability to edit that boundary's input. The CVE shows that input was never purely declarative. It could reach host-level command execution, which means the pipeline definition carried exactly the kind of risk teams reserve for application code and almost never apply to what they file under "configuration."
The blast radius compounds the point. The AI Gateway host holds JWT signing and validation keys, passed in as environment variables, that the gateway uses to authenticate its own requests. A successful exploit on that host would not just run one command; it would put those signing keys within reach. A sandbox escape on a service that holds its own authentication material is not a contained incident. It is a credential-rotation incident the moment command execution is confirmed.
Sources: Security Affairs: CVE-2026-90970, Critical GitLab AI Gateway Flaw Fixed
Part of why this kind of flaw slips past review in the first place is where flow configuration usually lives. A pull request against application code runs through a team's existing review habits almost by reflex: a diff, an assigned reviewer, a required check before merge. A flow, by contrast, typically gets created or edited directly through Duo Agent Platform's own interface, outside the repository entirely. A team can enforce strict code review on every line in its git history and still have zero review on the pipeline definition that tells an AI agent what to do, simply because nobody built a review step around a surface that never looked like a commit.
| What changes | Treated as infrastructure | Treated as code |
|---|---|---|
| Who can edit it | Anyone with workspace or pipeline access, no review step required | Gated the same as source code: a diff, an owner, a required review |
| What it is assumed to do | Declarative settings: strings, flags, step ordering | A template that renders and executes with host privileges |
| Review before it ships | Skipped, because it reads like a settings file, not application logic | Runs through the same gate as any other code change |
| Blast radius if it is wrong | Discovered during an incident, after the fact | Scoped and tested as part of the change, before merge |
If a gateway or pipeline host was running an affected version before the patch landed, treat its signing keys and service credentials as potentially exposed. Rotating them costs an afternoon; assuming they were never touched is the expensive guess.
What self-hosted operators should do now
- Upgrade to 19.2.4, 19.3.2, or 19.4.1 depending on your line. The AI Gateway image updates separately from core GitLab, so confirm the gateway itself moved, not just the main instance.
- Audit who currently holds Duo Agent Platform access, and check that list against who should actually be allowed to author or edit flow configurations.
- Rotate JWT signing and validation keys on any gateway that ran an affected version before patching, since command execution on that host could have exposed them.
- Start treating every flow configuration change going forward as a reviewable artifact: diffed, owned, and gated the same way a code change would be, not approved on sight because it looks like settings.
- Go back through flow configurations that already shipped before you knew to look, not just the ones created from today onward. A history of unreviewed templates is still unreviewed even after the gateway itself is patched.
CVE-2026-90970 is also not the only CVSS 9.9 template-related flaw GitLab has fixed in this part of the product in 2026. An earlier issue, CVE-2026-1868, also scored 9.9 and also involved template expansion of Duo Workflow Service definitions. Researchers who reviewed both have noted the similarity without claiming the two share a root cause. Two bugs with no confirmed shared root cause converging on the same score and the same general mechanism is not proof of a pattern by itself, but it is a reasonable prompt to ask the question twice instead of once. Taken together, they still point at the same layer recurring as a weak point: the step where a pipeline definition gets turned into a rendered, executed prompt, in a product area that is relatively new and still being hardened under real-world use.
Sources: The Hacker News: GitLab Patches Critical Self-Hosted AI Gateway Flaw, Cloud Security Alliance: research note on the GitLab AI Gateway sandbox escape
The pattern also echoes a different disclosure from earlier this year. GitSpawn showed seven AI coding agents treating a .git/config setting as inert data instead of attacker-reachable input, letting a crafted config run a command before the agent ever asked for approval. CVE-2026-90970 is the same category of mistake one layer up the stack: a configuration format that looks passive, sitting in front of an engine powerful enough to execute it. The same risk-tiering that approval gates for high-risk AI code changes apply to application changes is a reasonable starting point for a flow configuration too. A flow configuration that executes template logic against model output belongs in the same high-risk tier as a schema migration, not the low-risk tier reserved for a README edit.
Every one of these disclosures generalizes to the same fix: stop assuming a configuration file is passive because it looks like data instead of code. If it gets rendered, compiled, or executed by anything, it is code, and it needs a reviewer, not a rubber stamp.
This is the blind spot a convergence-gate-style review process is built to close, applied to a team's own pipeline rather than to GitLab's. TLM Forge treats a flow or workflow configuration change the same way it treats an application code change: an independent diff review reads what actually changed instead of trusting the commit message, and an adversarial red-team pass looks specifically for the injection and sandbox-escape risk a templating layer introduces, before a merge gate lets the change through. None of that would have caught CVE-2026-90970 itself; that bug lived inside GitLab's own template-sandbox implementation, not in a customer-authored flow file, and reviewing your own pipeline configuration does not patch someone else's template engine. What it does address is the far more common version of this problem: a team writing its own flow configuration, treating it as exempt from review because it is not technically application code, and shipping a change to an automated review or coding pipeline with less scrutiny than the pipeline is supposed to apply to everything else. See how it works.
Frequently asked questions
01What is CVE-2026-90970?
A CVSS 9.9 remote code execution vulnerability in GitLab's self-hosted AI Gateway, the service behind GitLab Duo Agent Platform. An authenticated user with Duo Agent Platform access could craft a malicious flow configuration to escape the prompt template sandbox and run arbitrary commands on the gateway host. GitLab disclosed and patched it on October 2, 2026.
02Which GitLab versions are affected by CVE-2026-90970?
Self-hosted AI Gateway versions 18.1.6 before 19.2.4, 19.3.0 before 19.3.2, and 19.4.0 before 19.4.1 are affected. GitLab fixed the flaw in 19.2.4, 19.3.2, and 19.4.1. GitLab.com, GitLab Dedicated, and self-managed instances using a GitLab-hosted gateway were not affected.
03What does a template sandbox escape mean?
A sandboxed template engine blocks template strings from reaching dangerous object attributes, built-in functions, or the interpreter directly. An escape means a crafted template gets past those blocks, often by walking an object's own attribute chain, to reach command execution on the host. GitLab's advisory does not name the specific engine involved.
04Has CVE-2026-90970 been exploited in the wild?
No. As of disclosure, both the CVE record and CISA's assessment within it list exploitation status as none observed, and no public proof-of-concept exploit code has been published. The flaw was reported responsibly through HackerOne by a researcher using the handle invisiblemeerkat.
05Why does a pipeline configuration file need the same review as application code?
When a configuration format includes template logic powerful enough to assemble prompts from user input, as GitLab's flow configurations do, it stops being a passive setting. It becomes a program that executes with the privileges of whatever renders it, which means it carries the same risk as application code and needs the same review.