GitLab Patched a CVSS 9.9 RCE in Its AI Gateway — Patch Guide for Self-Hosted Agent Builders

Описание и применение

GitLab выпустил патч для критической уязвимости CVE‑2026‑90970 в AI Gateway, позволяющей аутентифицированному пользователю с доступом к Duo Agent Platform выйти из песочницы и выполнить произвольные команды. Патч доступен для версий 19.2.4, 19.3.2 и 19.4.1. Руководство описывает, как проверить текущую версию, применить патч и убедиться в его работе.

Задача

An authenticated user with Duo Agent Platform access can escape the AI Gateway prompt‑template sandbox and execute arbitrary commands on self‑hosted GitLab AI Gateways (CVE‑2026‑90970, CVSS 9.9).

Результат

The patched AI Gateway prevents sandbox escape and arbitrary command execution, restoring secure operation for self‑hosted GitLab AI deployments.

Рабочий процесс

• Check running gateway image tag with docker ps --format '{{.Image}}' | grep ai-gateway or helm get values <release> --namespace <ns>
• If using Docker: stop and remove the container, pull the fixed image docker pull registry.gitlab.com/gitlab-org/modelops/apigw/self-hosted-v19.4.1-ee, then run it.
• If using Helm: set image.tag to the fixed tag (e.g., self-hosted-v19.4.1-ee) and run helm upgrade <release> <chart> --namespace <ns> --set image.tag=<fixed-tag>
• Verify the container is running the fixed tag with the same docker ps command and check logs with docker logs <container> --tail 50 for normal startup.
• Perform an AI feature smoke test (e.g., a code suggestion or Duo chat request) to confirm end‑to‑end functionality.

Доказательства

GitLab disclosed a critical flaw in its AI Gateway — the service that sits between your GitLab instance and the AI models behind Duo's coding and agent features. Tracked as CVE-2026-90970 and rated CVSS 9.9, it lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox and run arbitrary commands on the gateway.

Источник

Patches shipped the same day for the three supported release lines: 19.2.4, 19.3.2, and 19.4.1.

Источник

If you run your own gateway, this post tells you exactly whether you're exposed, which version to move to, and how to verify the fix.

Источник