CVE-2026-90970: GitLab AI Gateway RCE
ID: 453f9067-1f1f-57c6-8d7e-8e29adaba4e2
STIX ID: report--453f9067-1f1f-57c6-8d7e-8e29adaba4e2
Feed Name: SOCRadar Blog
Threat Score
GitLab patched CVE-2026-90970, a critical CVSS 3.1 9.9 template-engine vulnerability in the Self-Hosted AI Gateway that can enable authenticated Duo Agent Platform users to execute arbitrary commands; affected gateway releases should be upgraded to 19.2.4, 19.3.2, 19.4.1 or later, access should be restricted, and defenders should hunt for suspicious gateway activity, while no active exploitation has been confirmed.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.