plaincve:~$

// threat brief

CVE-2026-90970

GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may run arbitrary commands on the gateway

CVSS
9.9 CRITICAL
CISA KEV
Not listed
Weakness
CWE-1336
Topics
AI security

PlainCVE Team · Published 2026-10-12 · Updated 2026-10-13 · AI-assisted · Press brief ↓

AI review 2026-10-13 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Under certain conditions, a signed-in Duo Agent Platform user's crafted flow config may escape GitLab AI Gateway's template sandbox and run commands.

Who is affectedOrganizations running a self-hosted GitLab AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, or 19.4 before 19.4.1. Customers on GitLab.com, GitLab Dedicated, and Self-Managed instances that use a GitLab-hosted gateway need not act.
What happensUnder certain conditions (GitLab has not described them), an attacker can escape the prompt template sandbox and run arbitrary commands on the AI Gateway. GitLab rates it Critical; GitLab's advisory gives a CVSS 3.1 score of 9.9.
What to do nowUpgrade a self-hosted AI Gateway to 19.2.4, 19.3.2, 19.4.1 or later. No fix is listed for gateway releases from 18.1.6 through the 19.1 line; the lowest fixed version is 19.2.4. But GitLab's AI Gateway install guide says to use the self-hosted-vX.Y.*-ee gateway image matching the GitLab major.minor version (vX.Y), and the advisory does not say whether a 19.2.4 gateway works with GitLab 19.1 or earlier. ThreatFrontier's suggestion (not GitLab guidance) is that GitLab itself may need upgrading to 19.2 or later first, and to check with GitLab support before running a mismatched gateway version. No workaround has been published.
Affected versionsFrom 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1
Fixed versions19.2.4, 19.3.2, 19.4.1 or later; already deployed to GitLab-hosted gateways
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Timeline
  • First public 2026-10-02

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check whether you self-host the AI Gateway, and which version

    Only self-hosted AI Gateways need action. You are affected if the version is from 18.1.6 before 19.2.4, 19.3 before 19.3.2, or 19.4 before 19.4.1. GitLab.com, Dedicated, and Self-Managed customers using a GitLab-hosted gateway are already protected.

    Step 3Step 4
  2. 02No official way to check for compromise

    According to The Hacker News, the advisory gives no way to tell whether a gateway was attacked before it was updated. PlainCVE's suggestion: review who recently created or changed custom flow configurations, and look for unusual processes or outbound connections on the gateway host. These are general investigation leads, not official indicators.

    Step 2Step 5
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 19.2.4, 19.3.2, 19.4.1 or later

    These are the vendor's fixed releases. No fix is listed for releases from 18.1.6 through the 19.1 line; the lowest fixed version is 19.2.4 (as noted by The Hacker News). Compatibility caveat: GitLab's AI Gateway install guide (https://docs.gitlab.com/install/install_ai_gateway/) says to use the self-hosted-vX.Y.*-ee gateway image matching the GitLab major.minor version, and the advisory does not say whether a 19.2.4 gateway works with GitLab 19.1 or earlier. ThreatFrontier's suggestion (not GitLab guidance): GitLab itself may need upgrading to 19.2 or later, and check with GitLab support before running a mismatched gateway version.

    Step 3Step 4
  2. 02Can't upgrade yet: no published workaround

    No workaround has been listed. PlainCVE's suggestion: tighten Duo Agent Platform access until you can upgrade, though this is not guaranteed to block the attack.

    Step 1
RESPONDRespondIf you find signs of compromise
  1. 01If you suspect compromise, treat the gateway as compromised

    PlainCVE's suggestion (the sources we reviewed list no workaround or way to check for compromise): isolate the gateway host, redeploy a fixed version from a clean environment, and rotate the credentials and keys the gateway holds. This is a precaution, not a confirmation that anything leaked.

    Step 5
HARDENHardenPrevent the next one
  1. 01Run the AI gateway with least privilege

    PlainCVE's suggestion: give the gateway only the system permissions, network access and credentials it needs, so command execution does less damage.

    Step 5
  2. 02Review who can create or change flows

    PlainCVE's suggestion: regularly review the Duo Agent Platform user list and remove access that isn't needed.

    Step 1Step 2
Full remediation steps and notes
  1. Confirm you self-host first. Customers on a GitLab-hosted gateway need not act; GitLab has already deployed the fix.
  2. Pick the target version by your current line:
Current versionUpgrade to
18.1.6 to 19.1.xLowest fixed version is 19.2.4 (no fix listed for these lines; see compatibility in step 3)
19.2.x19.2.4 or later
19.3.x19.3.2 or later
19.4.019.4.1 or later
  1. On 18.1.6 to 19.1.x, check compatibility first. GitLab’s AI Gateway install guide says that if your GitLab version is vX.Y.-ee, you should use the AI Gateway image with the latest self-hosted-vX.Y.-ee tag. The advisory does not say whether a 19.2.4 gateway works with GitLab 19.1 or earlier, or whether fixes for older lines are planned (The Hacker News notes the same). ThreatFrontier’s suggestion (not GitLab guidance): getting a fixed gateway may mean upgrading GitLab itself to 19.2 or later, and check with GitLab support before running a mismatched gateway version.
  2. No stopgap. According to The Hacker News, no workaround is listed for gateways that can’t be updated yet, and the advisory gives no way to tell whether a gateway was attacked. The access-tightening and investigation items in the playbook are PlainCVE’s suggestions, not vendor guidance.
  3. GitLab says it contacted self-hosted AI Gateway customers before publishing the advisory; if you are one, check whether you received that notice.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may run arbitrary commands on the gateway: 1. A signed-in user with Duo Agent Platform access → 2. Submits a specially crafted flow configuration → 3. Special elements in the prompt template are not properly neutralized → 4. Escapes the prompt template sandbox → 5. Runs arbitrary commands on the AI GatewayCVE-2026-90970 · GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may runarbitrary commands on the gatewayAttackerYour systemA signed-in user with Duo Agent Platform access — The attacker must be an authenticated user with access to the Duo Agent Platform. This is not something an anonymous visitor can do. 1A signed-in userwith Duo AgentPlatform accessSubmits a specially crafted flow configuration — GitLab's advisory says the flaw is in the custom flow prompt template and is reached through "a specially crafted flow configuration"; GitLab has not disclosed what the crafted content is. 2Submits aspecially craftedflow configurationSpecial elements in the prompt template are not properly neutralized — The CVE record classifies it as CWE-1336 (improper neutralization of special elements used in a template engine). The messages of the fix commits (0141f228, 449740bc, caec81e3; those pages contain attack code, so this site does not link to them) say the fix blocks Jinja block-set NSRef writes on non-namespace objects; GitLab has not described the exact mechanism or the "certain conditions". 3Special elementsin the prompttemplate are notproperl…Escapes the prompt template sandbox — Templates are meant to run inside a sandbox (an isolated, restricted environment); this step breaks out of it. 4Escapes the prompttemplate sandboxRuns arbitrary commands on the AI Gateway — The attacker can run commands of their choice on the gateway host. 5Runs arbitrarycommands on the AIGatewayAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-90970-gitlab-ai-gateway-template-sandbox-escape · CC BY 4.0
GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may run arbitrary commands on the gateway: 1. A signed-in user with Duo Agent Platform access → 2. Submits a specially crafted flow configuration → 3. Special elements in the prompt template are not properly neutralized → 4. Escapes the prompt template sandbox → 5. Runs arbitrary commands on the AI GatewayCVE-2026-90970 · GitLab AI Gatewayprompt template sandbox escape: a DuoAgent Platform user may run arbitrarycommands on the gatewayA signed-in user with Duo Agent Platform access — The attacker must be an authenticated user with access to the Duo Agent Platform. This is not something an anonymous visitor can do. 1AttackerA signed-in user with Duo AgentPlatform accessSubmits a specially crafted flow configuration — GitLab's advisory says the flaw is in the custom flow prompt template and is reached through "a specially crafted flow configuration"; GitLab has not disclosed what the crafted content is. 2AttackerSubmits a specially craftedflow configurationSpecial elements in the prompt template are not properly neutralized — The CVE record classifies it as CWE-1336 (improper neutralization of special elements used in a template engine). The messages of the fix commits (0141f228, 449740bc, caec81e3; those pages contain attack code, so this site does not link to them) say the fix blocks Jinja block-set NSRef writes on non-namespace objects; GitLab has not described the exact mechanism or the "certain conditions". 3Your systemSpecial elements in the prompttemplate are not properlyneutralizedEscapes the prompt template sandbox — Templates are meant to run inside a sandbox (an isolated, restricted environment); this step breaks out of it. 4Your systemEscapes the prompt templatesandboxRuns arbitrary commands on the AI Gateway — The attacker can run commands of their choice on the gateway host. 5AttackerRuns arbitrary commands on theAI GatewayAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-90970-gitlab-ai-gateway-template-sandbox-escape
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    A signed-in user with Duo Agent Platform access

    The attacker must be an authenticated user with access to the Duo Agent Platform. This is not something an anonymous visitor can do.

    Defense: Grant Duo Agent Platform access only to people who need it (PlainCVE's suggestion; it narrows exposure but does not replace the fix).

  2. Attacker

    Submits a specially crafted flow configuration

    GitLab's advisory says the flaw is in the custom flow prompt template and is reached through "a specially crafted flow configuration"; GitLab has not disclosed what the crafted content is.

  3. Your system

    Special elements in the prompt template are not properly neutralized

    The CVE record classifies it as CWE-1336 (improper neutralization of special elements used in a template engine). The messages of the fix commits (0141f228, 449740bc, caec81e3; those pages contain attack code, so this site does not link to them) say the fix blocks Jinja block-set NSRef writes on non-namespace objects; GitLab has not described the exact mechanism or the "certain conditions".

    Defense: Upgrade to 19.2.4, 19.3.2, 19.4.1 or later.

  4. Your system

    Escapes the prompt template sandbox

    Templates are meant to run inside a sandbox (an isolated, restricted environment); this step breaks out of it.

    Defense: Upgrade to a fixed version.

  5. Attacker

    Runs arbitrary commands on the AI Gateway

    The attacker can run commands of their choice on the gateway host.

    Defense: Run the gateway with least privilege and limit the networks and credentials it can reach (PlainCVE's suggestion).

Who is affected

ConditionAffected?
Self-hosted AI Gateway, 18.1.6 through the 19.1 lineAffected; no fix is listed for these lines and the lowest fixed version is 19.2.4 (see “How to fix” for compatibility)
Self-hosted AI Gateway, 19.2.x below 19.2.4Affected
Self-hosted AI Gateway, 19.3.x below 19.3.2Affected
Self-hosted AI Gateway, 19.4.0Affected
Self-hosted AI Gateway, 19.2.4, 19.3.2, 19.4.1 or laterFixed
GitLab.com, GitLab Dedicated, or Self-Managed using a GitLab-hosted gatewayProtected according to GitLab; no action needed

The attacker must be a signed-in user with access to the Duo Agent Platform (GitLab’s AI agent feature). GitLab also says the attack works only “under certain conditions” but has not described them.

18.1.6 is only the earliest version the advisory lists as affected; GitLab has not said whether the problem started there.

How it works

The AI Gateway is a service between GitLab and AI models. In the Duo Agent Platform, users can define custom flows (sequences of AI agent steps), and those flows use prompt templates: a template engine fills placeholders with real content.

The CVE record classifies this flaw as CWE-1336 (improper neutralization of special elements used in a template engine), a class of weakness where a template engine does not properly handle special elements in its input. GitLab says the prompt template has a sandbox (an isolated environment that limits what it can do), but under certain conditions (not described by GitLab), a specially crafted flow configuration from an authenticated Duo Agent Platform user can escape it, ending in arbitrary command execution on the AI Gateway. GitLab has not said exactly how the template engine handles the crafted content.

GitLab has not published a separate technical write-up. The fixed versions 19.2.4, 19.3.2 and 19.4.1 come from GitLab’s advisory and the CVE record. OSV maps the fixed versions to three commits in the ai-assist repository: 0141f228 (tag self-hosted-v19.2.4-ee), 449740bc (19.3.2) and caec81e3 (19.4.1) (those commit pages contain attack code, so this site does not link to them). According to the ai-assist tag list (GitLab API), they merge the security-fix/jinja-nsref-assignblock-19-2-ee, 19-3-ee and 19-4-ee branches, and their messages say the fix blocks Jinja block-set NSRef writes on non-namespace objects. The code below is only a conceptual illustration of this class of weakness, not GitLab’s code.

The flawed approach (conceptual illustration):

Show code example(python)
# User-supplied content is compiled and run as a template
template = engine.from_string(user_flow_prompt)
output = template.render(context)

A safer approach (conceptual illustration):

Show code example(python)
# The template is fixed by the system; user content is passed in as data only
template = engine.get_template("trusted_prompt")
output = template.render(user_input=user_flow_prompt)

Scoring: GitLab’s advisory gives a CVSS 3.1 score of 9.9, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: it can be launched over the network, needs a low-privilege account, and its impact reaches beyond the component itself. The research notes contain no separate NVD score.

Timeline

DateEvent
2026-09-14CVE ID reserved
2026-09-17 (UTC-6)Fix commits in the ai-assist repository; release tags self-hosted-v19.2.4-ee, 19.3.2-ee and 19.4.1-ee all point to commits from this day (0141f228, 449740bc, caec81e3, per the GitLab API tag list; those commit pages contain attack code, so this site does not link to them). When they were pushed publicly could not be determined
Before 2026-10-02 (exact date not given)GitLab contacts self-hosted AI Gateway customers
2026-10-02CVE record published (datePublished), listing fixed versions 19.2.4, 19.3.2 and 19.4.1; CISA’s SSVC assessment lists exploitation as “none”. GitLab’s advisory page carries no date; The Hacker News reports GitLab disclosed the flaw that day
2026-10-07Still not in the CISA KEV catalog

Further reading

  • Exploitation status: Not in CISA KEV as of 2026-10-07; CISA’s SSVC assessment on the CVE record lists exploitation as “none”. GitLab’s advisory does not say whether it has been exploited. No source confirms exploitation in the wild, or exploitation before a patch existed (zero-day).
  • EPSS: GitHub’s advisory database lists an EPSS (estimated probability of exploitation in the next 30 days) of 0.00943, about 0.94%.
  • Work item not public: The GitLab work item linked from the CVE record (628842) is not public. Our analysis: the snapshot of that page we received had no vulnerability details, only embedded instructions aimed at AI agents, which we ignored as untrusted data.
  • OpenCVE’s added detail is unverified: Our analysis: OpenCVE’s AI-generated text adds a condition the vendor does not state (permission to modify flow configurations), and the same page says EPSS is “not available” while showing 0.00943, so we do not rely on its additions.
  • Credit: Responsibly disclosed by HackerOne user invisiblemeerkat.
  • Related weakness type: CWE-1336.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-13 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryGitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1 · GitLab · accessed 2026-10-07
  2. Patch / releaseai-assist self-hosted-v19 tags (GitLab API) · GitLab · accessed 2026-10-11
  3. CVE / NVD / OSVCVE-2026-90970 record (CVE Services API) · CVE Program, 2026-10-02 · accessed 2026-10-07
  4. OtherOSV entry for CVE-2026-90970 · OSV · accessed 2026-10-07
  5. OtherGitHub Advisory Database: CVE-2026-90970 · GitHub · accessed 2026-10-07
  6. NewsGitLab patches critical self-hosted AI Gateway flaw · The Hacker News · accessed 2026-10-07
  7. NewsCVE-2026-90970: critical GitLab AI Gateway flaw fixed · Security Affairs · accessed 2026-10-07
  8. NewsGitLab AI Gateway CVE-2026-90970: Duo Agent sandbox escape · ThreatFrontier · accessed 2026-10-07
  9. OtherInstall the GitLab AI Gateway · GitLab · accessed 2026-10-11
  10. OtherOpenCVE: CVE-2026-90970 · OpenCVE · accessed 2026-10-07

Press brief

In one sentence

On October 2, 2026, GitLab published CVE-2026-90970 and announced critical AI Gateway fixed versions 19.2.4, 19.3.2 and 19.4.1 (the commits those release tags point to are dated September 17, 2026; when they were pushed publicly is unknown). Under certain conditions, a signed-in user with Duo Agent Platform access could use a crafted flow configuration to escape the prompt template sandbox and run arbitrary commands on the AI Gateway. Only customers who host their own AI Gateway need to upgrade; GitLab-hosted gateways are already fixed. As of October 7, 2026, the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

Key facts

Severity
CVSS 3.1 9.9 (GitLab advisory), rated Critical by GitLab docs.gitlab.com
Fixed versions
19.2.4, 19.3.2, 19.4.1 docs.gitlab.com
CVE published
2026-10-02 cveawg.mitre.org
Weakness
CWE-1336 (improper neutralization in a template engine) cveawg.mitre.org
Reported by
HackerOne user invisiblemeerkat docs.gitlab.com

Confirmed

  • Under certain conditions, a signed-in user with Duo Agent Platform access can escape the prompt template sandbox and run arbitrary commands on the AI Gateway (GitLab advisory).
  • Fixed in 19.2.4, 19.3.2 and 19.4.1; the fix is already deployed to GitLab-hosted gateways.
  • Not in CISA KEV as of 2026-10-07; CISA's SSVC assessment on the CVE record lists exploitation as 'none'.

Unconfirmed / disputed

  • No source says whether it has been exploited in the wild, or exploited before a patch existed.
  • GitLab has not described what the 'certain conditions' are.
  • Which version introduced the flaw is unknown; 18.1.6 is only the earliest listed as affected.
  • OpenCVE's AI-generated text adds a condition (permission to modify flow configurations) that the vendor does not state.

Quotable line

A template is supposed to be a form to fill in; once it can run as code, a user who can shape it may be able to run commands on the gateway.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may run arbitrary commands on the gateway". PlainCVE. https://plaincve.date/en/vulns/cve-2026-90970-gitlab-ai-gateway-template-sandbox-escape (accessed YYYY-MM-DD)
BibTeX
@misc{cve202690970gitlabaigatewaytemplatesandboxescape2026,
  title  = {GitLab AI Gateway prompt template sandbox escape: a Duo Agent Platform user may run arbitrary commands on the gateway},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-90970-gitlab-ai-gateway-template-sandbox-escape},
  note   = {Updated 2026-10-13}
}