GitLab has patched a critical flaw in its self-hosted AI Gateway that could let a logged-in user run commands on the server. The company disclosed the bug, tracked as CVE-2026-90970, on October 2 with a CVSS severity score of 9.9 out of 10.

The flaw sits in the prompt template used by custom flows in the Duo Agent Platform. According to GitLab, an authenticated user with access to that platform could use a specially crafted flow configuration to escape the prompt template sandbox and execute arbitrary commands on the gateway.

Only organisations that host their own AI Gateway need to act. Fixed versions are 19.2.4, 19.3.2 and 19.4.1. GitLab says it already patched its own hosted gateways, so GitLab.com and GitLab Dedicated customers are protected.

The bug was reported through HackerOne by a researcher using the handle invisiblemeerkat. CISA lists exploitation status as “none”, meaning no attacks have been seen. It is the second critical gateway flaw this year, after a similar 9.9-rated bug patched in February.