GitLab Patched a CVSS 9.9 RCE in Its AI Gateway — Patch Guide for Self-Hosted Agent Builders

说明与用途

GitLab 发布了针对 AI Gateway CVE‑2026‑90970 的补丁，该漏洞允许具有 Duo Agent Platform 访问权限的已认证用户逃逸提示模板沙箱并执行任意命令。补丁适用于 19.2.4、19.3.2 和 19.4.1 版本。指南说明如何检查当前版本、应用补丁并验证其效果。

问题

An authenticated user with Duo Agent Platform access can escape the AI Gateway prompt‑template sandbox and execute arbitrary commands on self‑hosted GitLab AI Gateways (CVE‑2026‑90970, CVSS 9.9).

结果

The patched AI Gateway prevents sandbox escape and arbitrary command execution, restoring secure operation for self‑hosted GitLab AI deployments.

工作流

• Check running gateway image tag with docker ps --format '{{.Image}}' | grep ai-gateway or helm get values <release> --namespace <ns>
• If using Docker: stop and remove the container, pull the fixed image docker pull registry.gitlab.com/gitlab-org/modelops/apigw/self-hosted-v19.4.1-ee, then run it.
• If using Helm: set image.tag to the fixed tag (e.g., self-hosted-v19.4.1-ee) and run helm upgrade <release> <chart> --namespace <ns> --set image.tag=<fixed-tag>
• Verify the container is running the fixed tag with the same docker ps command and check logs with docker logs <container> --tail 50 for normal startup.
• Perform an AI feature smoke test (e.g., a code suggestion or Duo chat request) to confirm end‑to‑end functionality.

证据

GitLab disclosed a critical flaw in its AI Gateway — the service that sits between your GitLab instance and the AI models behind Duo's coding and agent features. Tracked as CVE-2026-90970 and rated CVSS 9.9, it lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox and run arbitrary commands on the gateway.

来源

Patches shipped the same day for the three supported release lines: 19.2.4, 19.3.2, and 19.4.1.

来源

If you run your own gateway, this post tells you exactly whether you're exposed, which version to move to, and how to verify the fix.

来源