CVE-2026-1868

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 18.8.0

Description The GitLab AI Gateway’s Duo Workflow Service component contains a flaw related to improper code generation. This issue allows authenticated attackers to cause a Denial of Service or achieve Remote Code Execution (RCE) by submitting specially crafted requests. The vulnerability stems from insecure template expansion of user-supplied data within crafted Duo Agent Platform Flow definitions.

Recommendations Upgrade to GitLab AI Gateway version 18.6.2 or later. Upgrade to GitLab AI Gateway version 18.7.1 or later. Upgrade to GitLab AI Gateway version 18.8.1 or later.