# GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)

> GitLab patched a critical (CVSS 9.9) flaw in the self-hosted AI Gateway that lets an authenticated user with Duo Agent Platform access escape the prompt template sandbox through a crafted flow configuration and run arbitrary commands on the gateway. Fixed in AI Gateway 19.2.4, 19.3.2 and 19.4.1; no active exploitation or public PoC has been reported.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-03T02:16:41.050Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2846
- **ID:** TL-2026-2846
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-90970, CVE-2026-1868

## Description

CVE-2026-90970 is an improper neutralization weakness (CWE-1336) in the custom flow prompt template handling of the GitLab AI Gateway, the service that brokers GitLab Duo / Duo Agent Platform requests to LLM back ends in Self-Managed Self-Hosted deployments. Per GitLab's advisory ("Improper Neutralization issue in custom flow prompt template impacts AI Gateway") and the NVD record, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9). Network-reachable, low complexity, low privileges and no user interaction are required. Scope is changed, reflecting that code execution in the gateway crosses the sandbox boundary and impacts resources beyond the template engine. Affected versions are AI Gateway 18.1.6 through 19.2.3, 19.3.0 through 19.3.1 and 19.4.0. Fixed versions are 19.2.4, 19.3.2 and 19.4.1. GitLab-hosted environments (GitLab.com, Dedicated, and Self-Managed instances using the GitLab-hosted gateway) are already protected and need no action; only self-hosted AI Gateway installations must upgrade following the official Self-Hosted AI Gateway documentation. The issue was reported through HackerOne by researcher invisiblemeerkat. GitLab conducted targeted outreach to affected customers before disclosure, and BleepingComputer reports no active exploitation, no public PoC and no attribution.

This is the second critical template-sandbox class issue in the same component in 2026. CVE-2026-1868 (also CVSS 9.9, same vector, fixed February 6, 2026 in AI Gateway 18.6.2, 18.7.1 and 18.8.1; found internally by GitLab's Joern Schneeweisz) described insecure template expansion of user-supplied data via crafted Duo Agent Platform Flow definitions in the Duo Workflow Service, enabling denial of service or code execution on the gateway. GitLab also remediated separate AI Gateway flaws involving crafted inline flow configuration overriding the HTTP Host header to redirect model requests and expose cloud credentials. Because the AI Gateway typically holds LLM provider credentials and signing material, command execution on it should be treated as a pivot point into connected cloud and model-provider accounts.

Separate from this flaw, GitLab core had a different, unauthenticated issue in September 2026: CVE-2026-85706, a CVSS 10.0 path traversal / authentication bypass in the repository commits API of GitLab CE/EE, added to CISA KEV on 2026-09-11 with public PoCs within hours. BleepingComputer cites it for context; it is not the same vulnerability and CVE-2026-90970 itself has no reported exploitation. No IOCs have been published; defenders should rely on version inventory, review of Duo Agent Platform flow definitions, and process/egress telemetry on the gateway host.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1068 Exploitation for Privilege Escalation
- T1552.004 Unsecured Credentials: Private Keys

## Sources

- [GitLab warns of critical RCE vulnerability in AI Gateway service](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/)
- [GitLab AI Gateway Patch Release 19.4.1 (CVE-2026-90970)](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/)
- [NVD - CVE-2026-90970](https://nvd.nist.gov/vuln/detail/CVE-2026-90970)
- [GitLab work item 628842 (CVE-2026-90970 issue)](https://gitlab.com/gitlab-org/gitlab/-/work_items/628842)
- [GitLab AI Gateway Critical Patch Release 18.6.2, 18.7.1, 18.8.1 (CVE-2026-1868)](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-18-8-1-released/)
- [Canadian Centre for Cyber Security - GitLab security advisory AV26-103](https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-103)
- [GitLab Critical Patch Release 19.4.1, 19.3.3, 19.2.7](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)
- [CISA: hackers now exploit max severity GitLab flaw in attacks (CVE-2026-85706, context)](https://bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks)
- [Wiz vulnerability database - CVE-2026-85706 (context)](https://www.wiz.io/vulnerability-database/cve/cve-2026-85706)
- [Rapid7 ETR - CVE-2026-85706 critical GitLab path traversal exploited in the wild (context)](https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2846