GitLab Warns of a Critical Flaw in Its AI Gateway: A Crafted Flow Configuration Escapes the Prompt Sandbox and Runs Commands on the Server

On 2 October, GitLab disclosed a critical vulnerability in its self-hosted AI Gateway, the service that sits between GitLab and the language models behind its Duo Agent Platform. Tracked as CVE-2026-90970, the flaw lets an authenticated user escape the prompt template sandbox through a specially crafted flow configuration and run arbitrary commands, according to BleepingComputer's report of GitLab's advisory.

GitLab has fixed it in versions 19.2.4, 19.3.2 and 19.4.1. The issue only affects self-managed deployments; GitLab's cloud-hosted AI Gateway is already patched. GitLab says it contacted self-hosted customers directly before disclosure, and no exploitation has been reported so far.

What actually went wrong

The root cause is an improper neutralisation weakness. The AI Gateway renders "flows", which are configurations that describe how an agent should behave, using prompt templates. Those templates were meant to be sandboxed. A crafted flow configuration could break out of that sandbox, and once it did, the attacker's input was running as code on the gateway host.

Exploitation requires an account with Duo Agent Platform permissions, so this is not an unauthenticated internet-facing bug. That is a smaller risk than an open door, but it is not a small one. In most organisations, a large number of developers hold exactly those permissions, and a single stolen developer token or a malicious insider is enough.

This is also GitLab's second critical disclosure in recent weeks. A September path traversal flaw, CVE-2026-85706, was added to CISA's list of actively exploited vulnerabilities, according to the same report.

Why an AI gateway is a high-value target

An AI gateway is not a normal web service. It typically holds:

• Credentials for one or more model providers, often with generous spending limits.
• Access to internal systems, because agents are connected to repositories, pipelines, tickets and databases so they can do useful work.
• Prompts and responses, which regularly contain source code, secrets and customer data.
• Configuration that is treated as data but behaves like code. A "flow" looks like settings, yet it is interpreted by a template engine. That is the same pattern behind many injection bugs, in a new place.

Code execution on that host is therefore not just code execution on one server. It is a position from which to read what the organisation asks its models, steal the keys it uses to ask, and act through every tool the agents are allowed to call.

The pattern to watch

We have covered this shape before. In the Plugin4Shell coding-agent story, the risk came from what an agent was allowed to pull in. In the OpenAI agent that reached a Medicare portal, it was what an agent was able to reach. Here, the weakness is in the layer that mediates between the two: the gateway that decides what agents may do.

The practical lessons are plain:

1. Inventory your AI gateways and agent platforms, including self-hosted ones nobody owns on paper. If you run GitLab Self-Managed with Duo Agent Platform, check your version today.
2. Patch to 19.2.4, 19.3.2 or 19.4.1, then rotate any model-provider keys stored on the gateway if you have any reason to doubt its integrity.
3. Treat agent configuration as code. Who can create or edit flows, and who reviews them, should be as controlled as who can merge to your main branch.
4. Limit what the gateway can reach. If the host is compromised, network segmentation and narrowly scoped credentials decide whether the damage is one server or the whole estate.
5. Log at the gateway. You cannot investigate an abuse of your AI platform if you never recorded which identity asked it to do what.

Where Obiguard Governance AI fits

Governance AI is built for the question this incident raises: who and what is using AI across the organisation, and under which rules?

Patching a vendor's gateway is the vendor's job and yours. Governance is what surrounds it:

A single policy layer for AI traffic. Obiguard routes model calls through a governed gateway where API keys, access and guardrails are defined once per team, project or agent, rather than scattered through each tool's own configuration. Provider keys stay out of individual developer environments.

Guardrails on inputs and outputs. Prompts and responses are checked against your policies, so secrets, personal data and out-of-scope requests are flagged or blocked before they leave or return.

An audit trail of every AI request. Every call is tied to an identity and recorded. If a platform like this one is abused, you can see which accounts, agents and models were involved, and what data moved.

Visibility into shadow deployments. Governance starts with knowing which AI services exist. A policy register and usage reporting make an unowned, self-hosted gateway something you can find and assign an owner to.

None of this replaces the GitLab patch. What it provides is a second line: even when a platform has a critical bug, your keys are scoped, your traffic is logged and your policies still apply.

The question to take away

The vulnerable component here was not a model. It was the plumbing around models, and it ran with the trust of everything it was connected to. So the question for your own organisation is: if one of your AI gateways were compromised tonight, would you know what it could reach, what it had stored, and who had been using it?

See how Governance AI works or talk to us about putting policy, keys and audit trails around your AI usage.