GitLab Patches Critical AI Gateway RCE Tied to Duo Agent Flow Templates

On October 2, 2026, GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to remediate CVE-2026-90970—a critical improper-neutralization flaw in custom flow prompt templates that, under certain conditions, could let an authenticated Duo Agent Platform user escape the template sandbox and execute arbitrary commands on a self-hosted AI Gateway. GitLab’s patch-release documentation rates the issue Critical at CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and credits researcher invisiblemeerkat for the disclosure. GitLab-hosted gateways—GitLab.com, Dedicated, and Self-Managed instances that use a GitLab-hosted AI Gateway—were already fixed; the urgent audience is Self-Managed customers running a self-hosted AI Gateway on affected builds.

Who is exposed on self-hosted gateways

The vulnerability lives in the AI Gateway component, not in every GitLab Rails process. Impacted ranges in the advisory are all AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. The attack story requires an authenticated principal who already has Duo Agent Platform access and can modify flow configurations. That is not an unauthenticated internet worm path, but it is a high-impact insider or compromised-account path: once template injection escapes the sandbox, the gateway host becomes an RCE beachhead with whatever privileges the gateway process holds—often network reach into model backends, secrets stores, and internal GitLab services.

The CVE record lists template injection (CWE-1336): specially crafted flow configuration content defeats neutralization that was supposed to keep prompt templates data-only. GitLab’s public advisory stays high-level on exploit mechanics—appropriate for a Critical patch day—and focuses operators on version math and upgrade docs for Self-Hosted AI Gateway installs. Targeted outreach to self-hosted gateway customers preceded the public post, which is consistent with GitLab’s handling of high-severity AI-platform defects.

Why Duo flow templates raise the stakes

Why this belongs on an AI/opensource security desk is the product surface. Duo Agent Platform treats flows as programmable agent workflows; prompt templates are a natural place to inject untrusted strings from issues, merge requests, or user-supplied agent configs. As more enterprises self-host AI gateways beside their GitLab instances, the gateway becomes a privileged translator between developer identity and model tooling. A sandbox escape there is closer to “agent control-plane RCE” than to a garden-variety XSS bug in a comment field.

Operational response is straightforward and time-sensitive. Inventory whether any environment runs a self-hosted AI Gateway; if yes, identify the exact gateway version and upgrade immediately to 19.2.4, 19.3.2, or 19.4.1 (or newer). Customers already on GitLab-hosted AI Gateway paths do not need gateway action for this CVE, per GitLab. After patching, review who can edit Duo Agent flows, rotate any secrets the gateway process could have read, and watch for anomalous command execution or outbound connections from gateway hosts during the vulnerable window. Subscribe to GitLab’s patch RSS feeds if AI Gateway is in production—agent-platform CVEs will keep arriving as Duo surfaces expand.

Patch, privilege review, and monitoring

This advisory is distinct from last week’s agent-sandbox and helpdesk zero-day narratives: it is a first-party GitLab control-plane defect with a numbered Critical CVE and explicit self-host versus hosted split. It is also a reminder that “authenticated only” still scores 9.9 when privileges are low and impact crosses into host command execution with changed scope.

Self-hosted AI Gateway operators should also map this CVE into their existing Duo rollout checklist. Environments that enabled Agent Platform early for coding or issue triage often granted flow-edit rights broadly; after 90970, treat flow authors as equivalent to a privileged automation role. Pair the version bump with least-privilege reviews, separate gateway hosts from GitLab application nodes where architecture allows, and confirm that template rendering no longer interpolates unsanitized configuration into executable contexts. GitLab’s install documentation for Self-Hosted AI Gateway is the upgrade path of record—follow it rather than informal container tag bumps that might miss gateway-specific images.

The broader pattern for 2026 agent platforms is familiar: richer programmable flows increase productivity and expand the template attack surface at the same time. Vendors that host the gateway themselves can patch centrally; customers who insist on data-plane isolation inherit the patch burden. CVE-2026-90970 is a concrete instance of that trade-off with a Critical score and a short list of fixed versions.

For Writeble’s cyber-security desk, CVE-2026-90970 is the October 2 agent-platform patch that self-hosted Duo shops cannot defer: upgrade the AI Gateway, then tighten who can author flow templates.