GitLab announced an urgent security patch in October 2026 for a critical vulnerability in its AI Gateway. GitLab is a connected developer platform that handles massive volumes of sensitive code and deployment workflows every day.
As a result, security flaws inside backend services create immediate entry points for malicious intruders. Security researchers tracked the newly disclosed flaw as CVE-2026-90970, and the bug carried a critical severity score of 9.9 out of 10. Regular logged-in users could send malformed text prompts to trick the system.
These bad prompts allowed attackers to break out of their safety cage. With this, attackers gained direct access to run unauthorized commands on company servers. As a result, organizations running self-hosted gateways faced immediate operational risks until they installed the fix.
Security Teams Disclosed Major Software Bug
Security teams first learned about the issue when an urgent advisory went live on October 2, 2026. The vulnerability impacted self-hosted installations running version 18.1.6 up through early 19.x builds.
GitLab managed cloud infrastructure directly, so engineers patched cloud users automatically behind the scenes. In contrast, organizations running self-hosted instances had to apply security patches manually. Engineers released emergency fixes across three software branches, including builds 19.2.4, 19.3.2, and 19.4.1.
Additionally, operations teams needed to pull updated container images right away. System owners using Kubernetes had to apply new Helm chart deployment values without delay.
Coding Errors Left Servers Open to Attack
The security issue stemmed from improper input neutralization inside the Duo Agent Platform. Specifically, custom flow prompt templates failed to isolate user inputs safely from template engines.
Therefore, authenticated users could send malicious flow configurations straight to underlying system layers. These malformed inputs broke past normal boundary controls.
As a result, attackers gained elevated privileges directly on the host server. Security analysts noted that template processing remained a recurring weakness across modern development tools. Small coding flaws inside text processing engines quickly created full access pathways for bad actors.
Security Breaches Risked Exposed GitLab Secrets
Self-hosted AI Gateways managed sensitive interactions between internal developer tools and external model providers. Because of central network placement, gateways served as prime targets for cyber attackers.
In addition, compromised gateways gave attackers direct access to JWT signing keys and API tokens. Intruders could leverage stolen credentials to move laterally across private corporate networks.
Furthermore, no temporary workarounds existed to block exploits without applying official software patches. Upgrading to fixed binary releases remained the sole method to defend server infrastructure.
Ultimately, system administrators must update vulnerable server containers to version 19.4.1 or higher today. Moving forward, organizations should enforce micro-segmentation around internal agent services to block future attacks.
