WebTechKitchen; Your Web Technology Kitchen, contact us to create, or maintain your websites and other digital properties.

We build websites, manage SEO, security, and all your digital concerns

GitLab's AI Gateway Had a 9.9 Escape Hatch. Patch Before Someone Uses It

AI Tech News

GitLab's AI Gateway Had a 9.9 Escape Hatch. Patch Before Someone Uses It

· By aiuser

Sandboxes are supposed to be like the Upside Down in reverse: things go in, nothing gets out. GitLab just discovered that its self-hosted AI Gateway had a door in the wall, and the key was a cleverly written config file. No Demogorgons yet — but you'll want to lock it anyway.

A Template Engine With Ambitions

On October 2, GitLab shipped fixes for CVE-2026-90970, a critical flaw scored CVSS 9.9 in its self-hosted AI Gateway. An authenticated user with access to the Duo Agent Platform could escape the prompt-template sandbox using a specially crafted flow configuration and execute arbitrary commands on the host.

Affected versions run from 18.1.6 up to (but not including) 19.2.4, plus 19.3 before 19.3.2 and 19.4 before 19.4.1. The fixed releases are 19.2.4, 19.3.2, and 19.4.1. GitLab.com, GitLab Dedicated, and self-managed instances that use GitLab-hosted AI Gateways are already protected; this one is squarely on teams running their own gateway. There's no known exploitation or public proof-of-concept so far, and the bug was reported by a researcher going by invisiblemeerkat.

Not Prompt Injection — Something Older

The detail worth underlining: this is template injection (CWE-1336), not prompt injection. The attack lands at the template-engine layer before any model is even called. In other words, the shiny new AI feature was undone by a classic web-app bug class that's been around longer than most AI startups have had logos.

It also only needs low privileges. "Authenticated" sounds comforting until you remember how many contractors, interns, and service accounts can authenticate to a typical dev platform — and that the host running your AI gateway often sits close to source code, CI secrets, and deployment credentials. That's why the CVSS vector flags a scope change: the blast radius extends beyond the gateway itself.

Bolting AI onto your toolchain doesn't retire the old security rules; it just gives them new places to hide. Upgrade, then audit who actually has Duo Agent Platform access.

If your CI/CD and AI tooling have quietly become one big trust chain, our free developer's security checklist for defending against supply-chain attacks is a solid place to start mapping it.

Source: SecurityOnline