GitLab's AI Gateway is the piece you run yourself when you want Duo's agents but not the traffic leaving your network. It also holds the keys that let it talk to your model providers and sign tokens. So when GitLab put out a patch on 2 October for a 9.9 in that component, it was worth reading past the headline. The Hacker News has the write-up, and Security Affairs covers the same disclosure.
What was found
CVE-2026-90970 sits in how the gateway handles prompt templates for custom flows on the Duo Agent Platform. Someone with a valid login and access to that platform can submit a crafted flow configuration, break out of the template sandbox and run commands on the gateway host. NVD files it as CWE-1336, improper neutralisation of special elements in a template engine. A HackerOne researcher going by invisiblemeerkat reported it.
Who needs to move
Only self-hosted gateways. GitLab says its own hosted gateway is already patched, so GitLab.com customers have nothing to do. If you run your own, the table is short:
- 18.1.6 up to 19.2.3: upgrade to 19.2.4
- 19.3.0 and 19.3.1: upgrade to 19.3.2
- 19.4.0: upgrade to 19.4.1
- Anything older than 18.1.6 gets no backport, so that is an upgrade project rather than a patch
There is no workaround. For Docker and Helm installs that means pulling the new image tag, not just restarting the container you have.
Why 9.9 and not 10
The attacker needs an account, so this is not a drive-by. In a company where every developer has Duo access, though, that is a large pool of people, plus anyone who has stolen a developer session. CISA lists exploitation as "none" as of the day of disclosure, and GitLab has not said otherwise. That can change quickly; template sandbox escapes have a habit of getting a public proof of concept within a week or two.
It is also not the first of its kind. The same bug class, CWE-1336 in the same product family, produced another 9.9 back in February (CVE-2026-1868). Two critical template escapes in eight months suggests the template layer deserves a proper review by GitLab and by anyone building similar things.
What I would check this week
- Find out whether anyone in your estate runs a self-hosted gateway at all. AI Gateway deployments tend to be set up by a platform team and forgotten.
- List who has Duo Agent Platform access and who can author custom flows. Flow authoring is the privilege that matters here, and it rarely needs to be broad.
- Rotate the JWT signing keys and model provider credentials on any gateway you cannot prove was clean before the upgrade.
- Look at the gateway's outbound connections. A host that normally only calls your model vendor should not be reaching anywhere else.
The wider point is that AI tooling servers are now part of the software delivery path, with the access that implies. Treat them like your build agents, not like a side project. If you would like help mapping and hardening that layer, email sales@halfteck.com.