Have you ever thought that just a logged-in user, with access to AI features, could take control of your entire enterprise GitLab server? It sounds like a scenario straight out of a hacker movie, but that is precisely what is happening right now.
GitLab has just released an emergency patch for an extremely critical vulnerability in the AI Gateway—the component that connects GitLab to AI models. This vulnerability has been rated with a severity score of 9.9/10 on the CVSS scale, almost reaching the absolute maximum.
And what is even more concerning is that this vulnerability only affects organizations that self-host their AI Gateway—meaning businesses that want to keep their AI data within their own environment. Because they wanted to be safer, they are now facing a greater risk.
Join me, SilverZ, with 20 years of witnessing security flaws making the entire tech industry break a sweat, as we analyze this incident from its roots. Because if you are running GitLab in your enterprise, this is no longer distant news.
What is vulnerability CVE-2026-90970 and how dangerous is it?
Before diving into the details, let us clarify the nature of the issue. The vulnerability is tracked under the identifier CVE-2026-90970, disclosed by GitLab on October 2, 2026, and rated as critical with a CVSS score of 9.9 out of 10.
So what makes this vulnerability so dangerous? Imagine the AI Gateway as a bridge connecting your GitLab instance to AI models. This bridge processes requests, sends them to the AI model, and brings back the results. But if someone can break through that bridge, they can execute commands directly on the server running the gateway.
According to the description, the vulnerability lies within the prompt template of a custom flow—an AI-driven workflow created by users on the Duo Agent Platform to automate multi-step tasks. A logged-in user with access to the Duo Agent Platform can exploit this vulnerability to "escape the prompt template sandbox" through a specially crafted flow configuration.
What is the consequence? An attacker can execute arbitrary commands on the gateway. This means they can do anything a system administrator can do: read sensitive data, install malware, or worse, take over the entire system.
Potential Threat: When JWT Signing Keys Are Stolen
What worries me particularly about this vulnerability is not just the ability to execute commands, but also what an attacker can steal.
A self-hosted AI Gateway stores signing keys for JSON Web Tokens (JWT)—and according to GitLab's installation guidelines, these keys must be treated as sensitive credentials. If an attacker obtains these keys, they can forge valid tokens to access the GitLab instance, or even the AI model providers your organization is connected to.
Think about that. Not only is your internal data threatened, but also your partnerships with AI providers—relationships built on trust and strict security agreements.
Who is affected and who can rest easy?
This is the most important part that any GitLab administrator needs to grasp. Not all GitLab users are affected by this vulnerability.
Organizations that can rest easy:
- Customers using GitLab.com – the gateway has been automatically patched by GitLab.
- Customers using GitLab Dedicated – also patched.
- Self-managed customers using GitLab-operated gateways – no action required.
Organizations that need to take immediate action:
- Self-managed customers who self-host their own AI Gateway.
GitLab sent update instructions to these customers before publicly disclosing the patch, a sign of the severity of the issue.
Affected versions and patches
Below is a summary table of the affected AI Gateway versions and their corresponding patched versions:
| Running Version | Patched Version |
|---|---|
| 18.1.6 and above, before 19.2.4 | 19.2.4 |
| 19.3, before 19.3.2 | 19.3.2 |
| 19.4, before 19.4.1 | 19.4.1 |
It is worth noting that no patched version is listed for versions below 19.2.4. This means all gateway versions from 18.1.6 up to the 19.1 line fall within the affected zone.
GitLab's installation guide recommends administrators use the gateway image that matches their GitLab minor version. However, the documentation does not specify whether gateway 19.2.4 is compatible with GitLab 19.1 or older, nor whether there are plans to patch older lines.
As of October 2, GitLab's maintenance policy only lists versions 19.4, 19.3, and 19.2 as receiving security patches. These are also the three lines whose gateways have been patched.
How to update the AI Gateway
If you are running a self-hosted AI Gateway, here is what you need to do right now:
For Docker deployments
Stop and remove the running container, then pull and run the new image tag. For example: self-hosted-v19.4.1-ee.
For Helm deployments
Set the new tag in the chart's image settings.
GitLab notes that no workarounds are listed for gateways that cannot be updated immediately. And more concerningly, there is no way to check whether a gateway has been compromised prior to updating.
Has the vulnerability been exploited?
This is probably the question every administrator is asking. The good news is that, according to the Cybersecurity and Infrastructure Security Agency (CISA), exploitation status is currently assessed as "none"—meaning there is no evidence of the vulnerability being exploited in the wild.
However, this does not mean you can lower your guard. The vulnerability has been publicly disclosed, and as I often tell my students: "When a vulnerability is disclosed, that is when the race begins." Attackers may be quietly developing exploits, and you do not want to be the first guinea pig.
The broader context: When AI becomes a new attack surface
This incident is not an isolated case. It is part of a more concerning trend: AI is becoming a new attack surface.
In the past, hackers typically targeted vulnerabilities in operating systems, databases, or web applications. But as organizations increasingly integrate AI into their workflows, AI components like the AI Gateway become attractive targets. They often have broad access, handle sensitive data, and are sometimes deployed without the rigorous monitoring applied to other critical systems.
This raises a big question: Are organizations investing enough in AI security? Or are they too focused on deploying AI rapidly while ignoring the accompanying security risks?
Lessons for Vietnamese businesses
Even if you do not use GitLab, this incident offers valuable lessons for any business deploying AI.
1. Inventory your AI assets
Do you know how many AI components you are running? Where are they deployed? Who has access? If you cannot answer these questions, you are managing risk blindly.
2. Prioritize patching for AI components
AI components are often viewed as "auxiliary" and receive less attention than databases or web servers. But as this incident shows, they can be the gateway to your entire system.
3. Limit access to the Duo Agent Platform
This vulnerability requires users to have access to the Duo Agent Platform. Review who truly needs this access and whether you can restrict it to a small group of trusted users.
4. There is no alternative to updating
GitLab does not provide a workaround for this vulnerability. This means updating is the only option. Do not delay.
AI safety is not a destination, it is a journey
I have watched the tech industry go through numerous security crises. From vulnerabilities in popular libraries to supply chain attacks, and now vulnerabilities in AI infrastructure. Every time, I see the same lesson repeated: what we build to connect and innovate is also what we need to protect.
The AI Gateway is a fantastic component. It allows enterprises to keep AI data in their own environment, maintain more control, and comply with strict regulations. But precisely because it is powerful, it also becomes an attractive target.
Vulnerability CVE-2026-90970 is not the end of the road for GitLab or the AI Gateway. It is a reminder that in the AI era, security cannot be an afterthought. It must be part of every architectural decision, every deployment process, and every operational plan.
And as I often say: "The smarter the technology, the wiser the people using it need to be."
If your business is running a self-hosted AI Gateway, how will you handle this vulnerability—update immediately even if it causes disruptions, or wait for a safer maintenance window? And more importantly, do you think organizations are devoting enough resources to protect their AI infrastructure, or are they too focused on rapid deployment while ignoring security risks? Share your perspective below, because in the AI era, safety is no longer an option—it is a responsibility!
0 Comment
Add your comment to this article