CVE-2026-90970 GitLab AI Gateway Critical Command Execution
Date: 2026-10-05
Tags: prompt-injection
Executive Summary
GitLab disclosed and patched CVE-2026-90970 (CVSS 9.9), a critical flaw in its AI Gateway that lets authenticated Duo Agent Platform users escape the prompt template sandbox and execute arbitrary commands on the host. Self hosted deployments supporting GitLab Duo are affected. No exploitation in the wild has been reported, but immediate patching is required because only low privileges are needed.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | CVE-2026-90970 GitLab AI Gateway Template Sandbox Escape |
| Attribution | Unknown (confidence: none) |
| Target | Self hosted GitLab Duo deployments |
| Vector | Authenticated Duo Agent Platform user crafts a malicious flow configuration that escapes the prompt template sandbox |
| Status | active |
| First Observed | 2026-10-02 |
Detailed Findings
According to rescana.com, on October 2, 2026 GitLab disclosed and patched CVE-2026-90970, a critical vulnerability in the AI Gateway component of self hosted GitLab Duo. The flaw is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) with a CVSS v3.1 score of 9.9. An authenticated attacker with low privileges and Duo Agent Platform access can create or modify a custom flow with a malicious prompt template. When the flow is processed, the AI Gateway escapes the template sandbox and executes arbitrary commands on the AI Gateway host. The scope is changed, meaning the attack crosses a security boundary. Rescana reported no public proof of concept or exploitation in the wild as of October 3, 2026.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Exploit Public-Facing Application | T1190 | Network based exploitation of GitLab AI Gateway through a crafted flow configuration. |
IOCs
Domains
_No IOCs published. CVE-2026-90970 is the only identifier._
Full URL Paths
_No IOCs published. CVE-2026-90970 is the only identifier._
Splunk Format
_No IOCs available for Splunk query_
Affected Platforms
GitLab AI Gateway self hosted deployments with Duo Agent PlatformDetection Recommendations
Patch GitLab to the latest version that fixes CVE-2026-90970. Monitor AI Gateway logs for unusual template processing or unexpected command execution. Restrict Duo Agent Platform access to trusted users and review custom flow configurations for suspicious prompt templates.
References
- [Rescana] CVE-2026-90970: Critical GitLab AI Gateway Vulnerability Enables Command Execution on Self-Hosted Deployments (2026-10-02) — https://www.rescana.com/post/cve-2026-90970-critical-gitlab-ai-gateway-vulnerability-enables-command-execution-on-self-hosted-deployments