GitLab Patches Critical AI Gateway Flaw Allowing Arbitrary Command Execution

GitLab released critical patches for CVE-2026-90970, a sandbox escape in the AI Gateway prompt-template mechanism that can allow authenticated users with Duo Agent Platform access to achieve arbitrary command execution on self-hosted AI Gateway hosts or containers. The flaw (CVSS 9.9) affects AI Gateway versions beginning with 18.1.6 up to—but excluding—patched releases (19.2.4, 19.3.2, 19.4.1); GitLab urges immediate upgrades for self-hosted deployments and recommends reviewing Duo Agent permissions and recent flow configurations, noting hosted GitLab gateways were already remediated.