GitLab Patched a CVSS 9.9 RCE in Its AI Gateway — Patch Guide for Self-Hosted Agent Builders

Description and use

GitLab released a patch for the critical CVE‑2026‑90970 vulnerability in its AI Gateway, which allows an authenticated user with Duo Agent Platform access to escape the prompt‑template sandbox and execute arbitrary commands. The patch is available for versions 19.2.4, 19.3.2, and 19.4.1. The guide explains how to check the current version, apply the patch, and verify its effectiveness.

Problem

An authenticated user with Duo Agent Platform access can escape the AI Gateway prompt‑template sandbox and execute arbitrary commands on self‑hosted GitLab AI Gateways (CVE‑2026‑90970, CVSS 9.9).

Outcome

The patched AI Gateway prevents sandbox escape and arbitrary command execution, restoring secure operation for self‑hosted GitLab AI deployments.

Workflow

• Check running gateway image tag with docker ps --format '{{.Image}}' | grep ai-gateway or helm get values <release> --namespace <ns>
• If using Docker: stop and remove the container, pull the fixed image docker pull registry.gitlab.com/gitlab-org/modelops/apigw/self-hosted-v19.4.1-ee, then run it.
• If using Helm: set image.tag to the fixed tag (e.g., self-hosted-v19.4.1-ee) and run helm upgrade <release> <chart> --namespace <ns> --set image.tag=<fixed-tag>
• Verify the container is running the fixed tag with the same docker ps command and check logs with docker logs <container> --tail 50 for normal startup.
• Perform an AI feature smoke test (e.g., a code suggestion or Duo chat request) to confirm end‑to‑end functionality.

Evidence

GitLab disclosed a critical flaw in its AI Gateway — the service that sits between your GitLab instance and the AI models behind Duo's coding and agent features. Tracked as CVE-2026-90970 and rated CVSS 9.9, it lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox and run arbitrary commands on the gateway.

Source

Patches shipped the same day for the three supported release lines: 19.2.4, 19.3.2, and 19.4.1.

Source

If you run your own gateway, this post tells you exactly whether you're exposed, which version to move to, and how to verify the fix.

Source