Date: October 2, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: DevSecOps / AI Infrastructure Security / Cloud Security / Vulnerability Research
Tags: GitLab, AI Gateway, Duo Agent, CVE-2026-90970, Remote Code Execution, Prompt Injection, Sandbox Escape, CVSS 9.9
Executive Summary
As enterprises race to integrate generative artificial intelligence and autonomous coding assistants into their software development lifecycles (SDLC), the underlying AI middleware infrastructure is rapidly emerging as a high-value target for adversaries. On October 2, 2026, GitLab issued an urgent security advisory warning of a critical remote code execution (RCE) vulnerability affecting the GitLab AI Gateway.
Tracked as CVE-2026-90970, the security defect carries a near-maximum CVSS v3.1 base score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). As reported by The Hacker News, BleepingComputer, and SQ Magazine, the vulnerability allows an authenticated attacker with access to the GitLab Duo Agent Platform to execute arbitrary system commands on the underlying operating system hosting the AI Gateway.
Crucially, while GitLab manages and automatically patched its cloud-hosted instances on GitLab.com and GitLab Dedicated, organizations that self-host the AI Gateway to preserve data sovereignty and keep proprietary source code within internal networks are directly exposed until manually patched.
Technical Deep-Dive: Architecture, Template Escapes, and Scope Escalation
To understand how a developer-facing AI assistant platform can lead to root-level host compromise, we examine the architecture of GitLab AI Gateway, the mechanics of Duo Agent workflows, and the template injection vector behind CVE-2026-90970.+-----------------------------------------------------------------------------------+
| GITLAB AI GATEWAY RCE (CVE-2026-90970) EXPLOITATION FLOW |
|---|
Authenticated User / Attacker Self-Managed GitLab Instance Self-Hosted GitLab AI Gateway (Python/FastAPI)
| | |
| 1. Initiates GitLab Duo Agent Task: | |
| Submits crafted workflow request | |
| with malicious prompt template payload |
|---------------------------------------->| |
| | 2. Proxies AI Request: |
| | Forwards agent flow JSON to self-hosted |
| | AI Gateway service via internal API |
| |--------------------------------------------->|
| | | 3. Insecure Template Interpolation:
| | | Template engine evaluates user
| | | payload without strict sanitization
| | |
| | | 4. PYTHON SANDBOX ESCAPE TRIGGERED:
| | | Malicious template breaks context:
| | | `__builtins__.__import__('os')`
| | | `.popen('cmd').read()`
| | |
| | | 5. Arbitrary OS Command Execution:
| | | Executes shell commands with AI
| | | Gateway daemon host privileges
| | |
| 6. Complete Host Compromise & IP Theft: | |
| - Extracts upstream LLM API tokens (OpenAI, Anthropic, Vertex AI) |
| - Intercepts confidential code repositories processed through AI Gateway |
| - Poisons Duo code generation suggestions across developer IDEs |
|<=======================================================================================|
1. Architectural Role of the GitLab AI Gateway
In modern GitLab environments, AI capabilities—such as code explanation, test generation, and automated refactoring—are not executed directly inside the main GitLab Rails monolithic application. Instead, GitLab employs the AI Gateway:
* Standalone Proxy Service: Written in Python using FastAPI, the AI Gateway acts as an abstraction and routing layer between GitLab instances, client IDEs, and large language model (LLM) providers (including Anthropic Claude, Google Vertex AI, Azure OpenAI, and on-premises models).
* The Self-Hosted Model: While standard customers use GitLab-hosted multi-tenant gateways, security-conscious enterprises (in finance, healthcare, defense, and semiconductor industries) frequently self-host the AI Gateway. This architecture guarantees that proprietary code snippets and prompts remain within corporate virtual private clouds (VPCs).
2. The Duo Agent Platform: Workflow Flows & Template Processing
GitLab Duo includes autonomous agentic capabilities (Duo Agent Platform) that execute multi-step software engineering tasks:
* Dynamic Prompt Compilation: When an agent tackles a coding problem, it orchestrates a "flow" configuration. This flow retrieves context (file trees, diffs, issue descriptions) and dynamically formats them into structured prompt templates before dispatching them to the target LLM.
* The Vulnerability (CVE-2026-90970): The vulnerability arises from improper neutralization of user-controlled input within prompt template compilation logic. An authenticated user possessing basic permissions to utilize the Duo Agent Platform can inject crafted template syntax into the flow configuration.
* Sandbox Escape: Rather than treating user input strictly as passive text data, the template engine dynamically evaluated embedded template expressions. Attackers were able to escape the template evaluation namespace, access Python reflection hooks (such as __class__.__mro__ and __builtins__), and invoke operating system command execution utilities (os.system / subprocess.Popen).
3. Why the CVSS Score is 9.9: Scope Change (S:C)
Under the Common Vulnerability Scoring System (CVSS v3.1), CVE-2026-90970 receives a score of 9.9 due to several key factors:
* Low Attack Complexity (AC:L): Exploitation does not require specialized timing or race conditions; standard API interactions trigger the flaw.
* Low Privileges Required (PR:L): Any regular authenticated user on the GitLab instance who has been granted permission to use GitLab Duo can trigger the exploit.
* Scope: Changed (S:C): This is the most critical metric. The attacker exploits a flaw in an application-level AI agent workflow, but the impact breaks out of the application boundary, granting full arbitrary command execution on the underlying operating system host.
Consequences for Enterprise AI and Supply Chains
Compromise of a self-hosted AI Gateway exposes organizations to catastrophic risks that extend far beyond traditional web application breaches:
1. Theft of Foundation Model Credentials: AI Gateways store highly sensitive API keys with high rate limits and administrative billing permissions for upstream commercial LLM providers (e.g., Anthropic, Google Cloud, OpenAI). Attackers can exfiltrate these keys for unmetered access or corporate espionage.
2. Exfiltration of Proprietary Code: Because the AI Gateway handles code completion, automated code reviews, and architectural explanations, virtually all intellectual property passing through developer IDEs traverses this service in plaintext.
3. AI Pipeline & Codebase Poisoning: By maintaining root access on the AI Gateway, adversaries can manipulate LLM responses in real-time. An attacker can subtly inject insecure code patterns, backdoors, or cryptographic flaws into the code suggestions served to internal developers, poisoning the organization's software supply chain.
Remediation & Defensive Hardening Blueprint
Organizations operating self-hosted GitLab AI Gateways must immediately implement the following defensive actions:
1. Upgrade Self-Hosted AI Gateway Versions Immediately
GitLab has released patched versions of the AI Gateway. Self-managed administrators must upgrade their deployments without delay:
* Upgrade to:
* AI Gateway 19.4.1
* AI Gateway 19.3.2
* AI Gateway 19.2.4
(Note: Customers utilizing GitLab-hosted cloud gateways or GitLab Dedicated require no action, as these environments were secured by GitLab).
2. Harden Container Isolation & Runtime Security
Ensure the AI Gateway container is deployed following strict defense-in-depth security baselines:
* Non-Root Execution: Verify the gateway daemon runs under a dedicated, unprivileged service account (UID 1000).
* Read-Only Root Filesystem: Deploy container images with read_only: true to prevent attackers from writing persistence scripts, webshells, or compiling tools.
* Drop Linux Capabilities: Enforce cap_drop: ["ALL"] and disable privilege escalation flags.
3. Restrict Network Ingress and Egress
* Ingress: Enforce strict network firewalls ensuring the AI Gateway only accepts connections from the authorized internal IP addresses of the primary GitLab instance.
* Egress: Restrict outbound internet access from the AI Gateway exclusively to the fully qualified domain names (FQDNs) and IP ranges of approved LLM API providers. Deny all arbitrary outbound internet traffic to disrupt reverse shells and automated data exfiltration.
4. SIEM & Runtime Threat Detection
Configure container runtime security tools (such as Falco, Cilium Tetragon, or cloud-native EDR) to alert on anomalous process creation within the AI Gateway namespace:
* Detect execution of interactive shells (/bin/sh, /bin/bash, /bin/zsh).
* Detect unauthorized network recon binaries (curl, wget, nc, socat, nmap).
* Alert on attempts to access container environment variables or local volume mounts containing LLM secrets.
________________
For in-depth DevSecOps vulnerability breakdowns, AI pipeline hardening guides, and enterprise threat research, subscribe to Digital Spying.