PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchGitLab has fixed CVE-2026-90970, a critical flaw that could let an authenticated user with Duo Agent Platform access execute arbitrary commands on an affected AI Gateway. Operators of self-hosted AI Gateway installations should upgrade to the patched release for their version branch. GitLab says its hosted gateways are already fixed, so GitLab.com, GitLab Dedicated, and self-managed GitLab instances using a GitLab-hosted AI Gateway need no action for this advisory.
What is CVE-2026-90970?
GitLab describes CVE-2026-90970 as an improper neutralization issue in custom flow prompt templates. Under certain conditions, an authenticated user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt-template sandbox and execute arbitrary commands on the AI Gateway.
As an Amazon Associate I earn from qualifying purchases.
GitLab rates the vulnerability Critical, with a CVSS 3.1 score of 9.9 and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That score describes severity; it is not a count of affected installations or evidence of confirmed compromises. GitLab credits invisiblemeerkat for responsible disclosure.
Which AI Gateway versions are affected, and what fixes them?
Check the AI Gateway version—not the version of the GitLab application—and select the first fixed release in the matching branch:
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Affected AI Gateway version | First fixed AI Gateway version |
|---|---|
| 18.1.6 up to, but not including, 19.2.4 | 19.2.4 |
| 19.3 before 19.3.2 | 19.3.2 |
| 19.4 before 19.4.1 | 19.4.1 |
These ranges and fixed releases are from GitLab’s official AI Gateway patch advisory. If your self-hosted gateway is in one of the affected ranges, upgrade it to the listed fixed release for its branch as soon as possible.
Do GitLab.com or self-managed GitLab users need to patch?
GitLab says it has already fixed the hosted AI Gateways. GitLab.com and GitLab Dedicated users, as well as operators of self-managed GitLab instances that use a GitLab-hosted AI Gateway, do not need to take action for this advisory. The upgrade recommendation applies to affected self-hosted AI Gateway installations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known about exploitation?
The advisory specifies an authenticated user with Duo Agent Platform access and a specially crafted flow configuration, but does not describe the “certain conditions” in further detail. It does not establish whether attackers have exploited the flaw or provide indicators of compromise. The Hacker News reported on the issue on October 2, 2026; that is the report’s date, not a verified advisory publication date. See its coverage for secondary context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
