# GitLab AI Gateway: a flow config escapes the prompt template sandbox

> A crafted Duo flow configuration turns GitLab's self-hosted AI Gateway into a place to run arbitrary commands.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** GitLab
- **Disclosed:** 2026-10-02
- **CVE:** CVE-2026-90970
- **CVSS:** 9.9
- **Affects:** GitLab AI Gateway, GitLab Duo Agent Platform
- **Research by:** invisiblemeerkat
- **Primary source:** https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
- **Page:** https://theinjection.dev/items/gitlab-ai-gateway-prompt-template-escape/

CVE-2026-90970 lets an authenticated GitLab user with Duo Agent Platform access break out of the AI Gateway prompt template sandbox and run commands on the gateway. GitLab rates it 9.9 and fixed it in 19.2.4, 19.3.2 and 19.4.1.

## What happened

GitLab published a critical AI Gateway patch release covering versions 19.2.4, 19.3.2 and 19.4.1, and the CVE record for CVE-2026-90970 reached NVD on October 2, 2026. GitLab credits invisiblemeerkat with responsibly disclosing the flaw, and says it contacted Self-Hosted AI Gateway customers directly before publishing.

## How it works

The AI Gateway renders Duo custom flows through a prompt template engine. GitLab describes the weakness as improper neutralization in that template, so a specially crafted flow configuration escapes the template sandbox instead of being treated as data. The escape ends in arbitrary command execution on the AI Gateway itself. The CVE record classes it as CWE-1336, a template engine injection.

## Who is affected

Self-hosted AI Gateway operators running any version from 18.1.6 before 19.2.4, 19.3 before 19.3.2, or 19.4 before 19.4.1. GitLab states that GitLab.com, GitLab Dedicated and Self-Managed instances using a GitLab-hosted AI Gateway are already protected. Exploitation needs an account that holds Duo Agent Platform access.

## What to do

Upgrade the self-hosted AI Gateway to 19.2.4, 19.3.2 or 19.4.1. GitLab lists no workaround, so until the upgrade lands, review which accounts hold Duo Agent Platform access, since that access is the precondition for the attack.

## Quick facts

- **CVE:** CVE-2026-90970
- **CVSS 3.1:** 9.9 (GitLab)
- **Affected:** AI Gateway 18.1.6 to before 19.2.4, 19.3 to before 19.3.2, 19.4 to before 19.4.1
- **Fixed in:** 19.2.4, 19.3.2, 19.4.1
- **Not affected:** GitLab.com, GitLab Dedicated, Self-Managed on a GitLab-hosted gateway
- **Found by:** invisiblemeerkat
- **Attack type:** Prompt template sandbox escape to command execution

## Questions

### Is GitLab.com affected by CVE-2026-90970?

GitLab.com is not affected by CVE-2026-90970. GitLab states that GitLab.com, GitLab Dedicated, and Self-Managed instances that use a GitLab-hosted AI Gateway are already protected and need no action. Only organizations running their own Self-Hosted AI Gateway must upgrade, which GitLab recommends doing immediately. GitLab says it contacted Self-Hosted AI Gateway customers directly before publishing the release.

### Which AI Gateway versions fix CVE-2026-90970?

AI Gateway 19.2.4, 19.3.2, and 19.4.1 fix CVE-2026-90970. GitLab lists all versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 as affected. The advisory offers no workaround, so self-hosted operators should upgrade to one of the three patched releases rather than attempt mitigation.

### Who can exploit the GitLab AI Gateway sandbox escape?

An authenticated user with Duo Agent Platform access can exploit CVE-2026-90970, according to GitLab. That user supplies a crafted flow configuration, escapes the prompt template sandbox, and can run commands on the AI Gateway host. Anonymous internet users cannot reach the flaw, so reviewing who holds Duo Agent Platform access reduces exposure while you schedule the upgrade.

## Sources

1. [GitLab Patch Release](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/)
2. [NVD Record](https://nvd.nist.gov/vuln/detail/cve-2026-90970)