The gateway connecting your DevOps platform to AI models is an attack surface too: on October 2, GitLab patched a CVSS 9.9 flaw that turns a manipulated flow configuration into command execution.
According to The Hacker News, GitLab fixed CVE-2026-90970, a critical vulnerability with a CVSS score of 9.9 in the AI Gateway, the component that routes Duo Agent Platform requests to the models. The flaw lets an authenticated user with access to Duo Agent Platform “escape the prompt template sandbox through a specially crafted flow configuration” and achieve arbitrary command execution on the gateway. The report came in through HackerOne from a researcher identified as “invisiblemeerkat.”
The CVE record classifies the weakness as CWE-1336 (improper neutralization of special elements used in a template engine). Put simply: the gateway builds prompts from templates that are rendered inside a sandbox. If whoever controls the flow configuration can slip in expressions the sandbox doesn’t block, those expressions run with the gateway process’s permissions, not the user’s. It’s the same class of bug as web template engines from years ago, now inside agent infrastructure.
One relevant detail The Hacker News points out: in February, CVE-2026-1868 had been fixed, also CVSS 9.9 and also a template-engine weakness in the same component. This time’s advisories don’t mention the earlier flaw. Two critical issues of the same family in eight months suggest the template sandbox is a priority area for review.
GitLab says customers on GitLab.com, GitLab Dedicated, and self-managed instances that use a GitLab-hosted gateway don’t need to do anything: it’s already fixed. Only those running a self-hosted AI Gateway need to upgrade to 19.2.4, 19.3.2, or 19.4.1, depending on their branch.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel