The integration of artificial intelligence into enterprise software development pipelines has vastly accelerated coding productivity, but it also introduces novel attack vectors that require immediate attention from security teams.
GitLab recently issued an urgent security bulletin regarding a critical vulnerability within its AI Gateway, an independent component specifically designed to securely facilitate GitLab Duo AI features.
Tracked under the vulnerability identifier CVE-2026-90970, this severe flaw commands an alarming Common Vulnerability Scoring System (CVSS) severity score of 9.9 out of 10.
The core issue revolves around the potential for remote code execution, representing a worst-case scenario in cybersecurity where a threat actor gains the ability to run arbitrary system commands on the host server.
For organizations that explicitly operate self-hosted instances of this gateway to maintain strict data sovereignty and keep their sensitive AI workloads internalized, this represents a significant risk to their broader network infrastructure.
The sheer severity of the assigned score highlights the total compromise of confidentiality, integrity, and availability that could occur if the vulnerability is successfully exploited by a malicious actor.
Unpacking the Sandbox Escape Mechanism
The technical mechanics of this vulnerability center directly on the improper backend handling of custom flow prompt templates within the AI Gateway. In a secure and well-architected application, user prompt templates are processed strictly within a confined sandbox environment to ensure that complex inputs cannot break out and interact with the underlying operating system.
However, a fundamental flaw in this boundary allows a specially crafted flow configuration to bypass these restrictions entirely.
According to a recent vulnerability breakdown and mitigation report published by Cybersecurity news, an attacker could escape this sandbox boundary and achieve direct, arbitrary command execution on the gateway service itself.
It is highly important to note that this is not an unauthenticated attack vector. To successfully execute this exploit, the threat actor must already possess a valid account with established access to the Duo Agent Platform.
While this prerequisite slightly lowers the likelihood of mass, automated exploitation by external scanners across the internet, the danger remains incredibly acute for insider threats or compromised developer accounts that already hold the necessary permissions.
The security researcher known as invisiblemeerkat was credited with responsibly disclosing this complex sandbox escape, and fortunately for the enterprise community, there are currently no reports of active exploitation in the wild.
Deployment and Mitigation Strategies
Impact depends heavily on your deployment setup. GitLab already patched GitLab.com, GitLab Dedicated, and cloud-managed gateway connections. Therefore, cloud customers face no risk.
Instead, the vulnerability strictly affects self-hosted AI Gateways. Vulnerable deployments include versions 18.1.6 up to the latest patched releases. Administrators must immediately upgrade their gateway services to version 19.2.4, 19.3.2, or 19.4.1. Always verify the standalone gateway version rather than just your main GitLab version.
Remediation requires careful container management. For Docker environments, teams must stop and delete the old container before pulling the updated image. Always confirm the new image digest after deployment.
Kubernetes and Helm clusters require extra vigilance. Cached local images can accidentally block secure updates. Therefore, teams should enforce strict pull policies and limit outbound traffic from the gateway. These quick steps will eliminate the remote code execution threat.
