# CVE-2026-90970: GitLab AI Gateway prompt sandbox escape in Duo Agent Platform

Source: https://junglewise.ai/threats/cve-2026-90970-gitlab-has-remediated-a-vulnerability-in-the-gitlab-ai-gateway  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-90970 · Severity: critical · CVSS 9.9 · Published 2026-10-02

GitLab AI Gateway is a component that processes AI requests for GitLab instances. An authenticated user with access to the Duo Agent Platform could bypass the sandbox protections that isolate AI prompt processing, execute arbitrary commands on the AI Gateway service, and potentially gain control of the system or access sensitive data.

Vendors: [GitLab](https://junglewise.ai/threats/vendors/gitlab).

## Quick answers

**Is CVE-2026-90970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90970 being exploited in the wild.

**How severe is CVE-2026-90970?** Critical severity, with a CVSS score of 9.9, published 2 October 2026.

**Which products and versions are affected?** GitLab AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, 19.4 before 19.4.1.

**Is there a fix for CVE-2026-90970?** Yes: fixed in AI Gateway 19.2.4, 19.3.2, 19.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90970 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-90970?** Check whether you run GitLab AI Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in AI Gateway 19.2.4, 19.3.2, 19.4.1

## Technical details

The vulnerability is a sandbox escape in the AI Gateway's prompt template processing logic, accessible to authenticated users with Duo Agent Platform permissions. By crafting a malicious flow configuration, an attacker can break out of the isolated execution environment and achieve arbitrary command execution on the underlying AI Gateway host. The vulnerability affects versions 18.1.6 through 19.4.0 and has been patched in 19.2.4, 19.3.2, and 19.4.1.

## Affected products

- GitLab AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, 19.4 before 19.4.1

## Timeline

- 2026-10-02: disclosed

## References

- [https://gitlab.com/gitlab-org/gitlab/-/work_items/628842](https://gitlab.com/gitlab-org/gitlab/-/work_items/628842)