Arbitrary Command Execution Vulnerability in GitLab AI Gateway Component

CVE-2026-90970

What is CVE-2026-90970?

CVE-2026-90970 is a significant vulnerability found in the GitLab AI Gateway component, a tool designed for integrating artificial intelligence functionalities within the GitLab DevOps platform. This vulnerability affects versions of the AI Gateway from 18.1.6 prior to 19.2.4, as well as specific versions 19.3 and 19.4 before 19.3.2 and 19.4.1, respectively. Under certain conditions, it presents an avenue for authenticated users with Duo Agent Platform access to escape the confines of the prompt template sandbox. By exploiting this vulnerability through a specially crafted flow configuration, it is possible to execute arbitrary commands on the AI Gateway. The implications of this are concerning, as such command execution could allow attackers to manipulate system operations, potentially leading to unauthorized actions that compromise system integrity and availability.

Potential impact of CVE-2026-90970

1. Unauthorized Command Execution: The primary risk associated with CVE-2026-90970 is that it enables an authenticated user to execute arbitrary commands. This capability poses a direct threat to the security of the GitLab AI Gateway, effectively allowing unauthorized access to critical system functions and data.

2. System Compromise: Given that the vulnerability allows for arbitrary command execution, there is a substantial risk of complete system compromise. Attackers could leverage this to alter configuration settings, deploy malicious software, or disrupt normal operations, leading to significant operational downtime.

3. Exposure of Sensitive Data: The exploitation of this vulnerability could result in the exposure of sensitive information stored within the GitLab environment. If an attacker gains sufficient control, they could access confidential data or intellectual property, leading to potential data breaches and loss of customer trust.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

News Articles

The Hacker News

CVE-2026-90970

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

GitLab fixed CVE-2026-90970, a 9.9 AI Gateway flaw that could let logged-in Duo Agent Platform users run commands on self-hosted gateways.

References