Recommended Free Tools
If you run a GitLab Self-Hosted AI Gateway, check its version and upgrade an affected installation to the fixed release for its branch: 19.2.4, 19.3.2, or 19.4.1. GitLab identifies CVE-2026-90970 as a critical prompt-template sandbox escape that could allow arbitrary command execution on the Gateway. GitLab says the fix is already deployed to its hosted Gateway, so customers using that service do not need to take action for this issue. Check GitLab’s release notice to confirm the affected ranges and the right target for your branch.
Am I affected by the GitLab AI Gateway vulnerability?
You may be affected if you operate a GitLab Self-Hosted AI Gateway running a version in one of the ranges GitLab lists as impacted. The documented scenario involves an authenticated user with Duo Agent Platform access and a specially crafted flow configuration. GitLab says that configuration could escape the prompt-template sandbox and execute arbitrary commands on the Gateway. The advisory does not establish that any particular installation was exploited.
As an Amazon Associate I earn from qualifying purchases.
GitLab rates CVE-2026-90970 CVSS 9.9 under CVSS 3.1 and labels the patch critical. The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The described impact is command execution on the Gateway, not just manipulation of a prompt. GitLab’s security release notice is the authority for determining whether a particular version is in scope.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which AI Gateway versions are vulnerable?
GitLab lists these impacted ranges. Match the version actually deployed—not just the GitLab application version—to the official table.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| AI Gateway branch or range | GitLab-listed affected versions | Fixed release |
|---|---|---|
| 18.1.6 up to, but not including, 19.2.4 | All versions from 18.1.6 before 19.2.4 | 19.2.4 |
| 19.3 | Versions before 19.3.2 | 19.3.2 |
| 19.4 | Versions before 19.4.1 | 19.4.1 |
These are branch-specific targets, not three interchangeable versions. If your deployed version or branch is not clearly covered by the summary above, use the impacted-version table in GitLab’s release notice before deciding it is safe.
Does exploitation require authentication?
Yes. GitLab’s documented condition requires an authenticated user with Duo Agent Platform access, as well as a specially crafted flow configuration. The notice does not describe this as an unauthenticated attack, nor does it say that every configuration or request triggers command execution.
Rank #2
What should I upgrade to?
Upgrade an affected self-hosted Gateway to the fixed version for its branch. GitLab strongly recommends updating affected Self-Hosted AI Gateway installations immediately.
- Identify the Gateway deployment model and deployed version. Confirm whether the Gateway is self-hosted or GitLab-hosted, then check the version of the Gateway image or release in use.
- Match the version to GitLab’s affected-version table. Use the exact branch and ranges in the critical patch notice; do not select a target solely from the GitLab instance’s version.
- Deploy that branch’s fixed release. The targets named by GitLab are 19.2.4, 19.3.2, and 19.4.1. Follow the current installation procedure for your deployment method rather than copying an image reference or command from an older example.
- Verify the running Gateway. Confirm that the deployed image or release is the intended fixed version and that the service is healthy after the rollout.
For Kubernetes/Helm or Docker, GitLab’s AI Gateway installation guidance covers image digests and pull policies. Use the current page for image references and commands; tags and examples can change, and a tag alone may not ensure that a node refreshes an image when a tag is reused.
Do GitLab.com customers need to take action?
GitLab says it has already deployed the fix to the GitLab-hosted AI Gateway. Its notice says GitLab.com, GitLab Dedicated, and Self-Managed instances using the GitLab-hosted Gateway are protected and do not need to act for this issue. This distinction depends on the Gateway deployment model: a Self-Managed GitLab instance can still use GitLab’s hosted Gateway. The urgent upgrade instruction applies to affected self-hosted Gateway installations.
What security controls help beyond the patch?
These controls reduce operational risk but do not remediate CVE-2026-90970. Install the fixed release first; treat the following as defense in depth.
- Restrict outbound access. GitLab’s installation guidance recommends allowing the Gateway container to reach only the GitLab instance, configured model-provider endpoints, and
customers.gitlab.comfor license validation, unless an offline license is used. Test firewall rules outside production because overly restrictive egress can break functionality. - Protect signing and validation keys. Store the self-hosted Gateway’s keys as sensitive credentials. GitLab’s documentation lists separate key pairs for the AI Gateway and Duo Agent Platform service.
- Use stable, explicitly versioned releases. GitLab warns that backward compatibility is not guaranteed with nightly builds. For Kubernetes/Helm and Docker, follow the current guidance for image digests and pull policies so deployments receive the intended updates.
- Secure externally exposed deployments. The AI Gateway Helm chart documentation describes enabling the Gateway API and configuring service endpoints; it recommends internal TLS for end-to-end encryption from client to pod. These deployment settings are not a substitute for the CVE patch.
- Apply agent guardrails. GitLab’s agentic security guidance discusses remote and Dev Container sandboxes, output sanitization, approvals, careful tool selection, and prompt-injection detection. Its prompt guardrails documentation cautions that safeguards reduce risk but cannot guarantee complete protection.
Is there a separate GitLab 19.2.0 upgrade issue?
Yes, but it is separate from CVE-2026-90970. GitLab’s 19.x upgrade notes describe a configuration issue on direct upgrades to GitLab 19.2.0 that could clear the Local AI Gateway URL and Local URL for the GitLab Duo Agent Platform service, stopping Duo Self-Hosted features until the endpoints were restored. GitLab says this did not occur when upgrading to 19.2.1 or later. If you upgraded to 19.2.0 and those endpoints are missing, re-enter the correct URLs at Admin > GitLab Duo > Configuration > Service endpoints and save.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
