CVE-2026-90970

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 19.2.3 GitLab AI Gateway versions 19.3 through 19.3.1 GitLab AI Gateway versions 19.4 through 19.4.0

Description An improper neutralization weakness in the self-hosted AI Gateway service allows an authenticated user with Duo Agent Platform access to escape the prompt template sandbox. By utilizing a specially crafted flow configuration, an attacker can achieve arbitrary command execution on the AI Gateway instance.

Recommendations Update GitLab AI Gateway versions 18.1.6 through 19.2.3 to version 19.2.4. Update GitLab AI Gateway versions 19.3 through 19.3.1 to version 19.3.2. Update GitLab AI Gateway versions 19.4 through 19.4.0 to version 19.4.1.