GitLab disclosed a critical AI Gateway vulnerability on October 2, 2026, urging customers running their own gateway to patch immediately. Tracked as CVE-2026-90970 and rated CVSS 9.9, the flaw can allow command execution. BleepingComputer and The Hacker News reported the warning that day.

GitLab documentation describes self-hosting as a way to keep AI requests and responses within an organization’s environment while choosing its own language models. The gateway supports GitLab Duo features, and customers operating this infrastructure are responsible for its maintenance.

According to GitLab’s security advisory, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox through a crafted flow configuration under certain conditions. The resulting access could allow arbitrary commands to run on the AI Gateway.

The advisory lists affected gateway releases from 18.1.6 before 19.2.4, the 19.3 branch before 19.3.2, and the 19.4 branch before 19.4.1. GitLab credits researcher invisiblemeerkat with responsibly disclosing the issue. The advisory does not report active exploitation.

GitLab says its hosted gateways have already received a fix. Customers using GitLab.com, GitLab Dedicated or a Self-Managed instance connected to a GitLab-hosted gateway need no action for this issue.

For affected self-hosted installations, GitLab recommends upgrading immediately to AI Gateway 19.2.4, 19.3.2 or 19.4.1. The company says it contacted self-hosted gateway customers before publishing the advisory and directs administrators to its gateway installation documentation for update instructions.