{"data":{"id":"0c1cd85f-657f-466c-9c1a-31e20cfcc42f","title":"GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers","summary":"GitLab disclosed CVE-2026-90970, a critical flaw rated 9.9 in the AI Gateway that lets a logged-in user with Duo Agent Platform access escape the prompt template sandbox through a specially crafted flow configuration. The escape could lead to arbitrary command execution on the gateway, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.","solution":"Fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. GitLab strongly recommends that self-hosted gateway customers update immediately. For Docker deployments, stop and remove the running container, then pull and run the new image tag, for example self-hosted-v19.4.1-ee. Helm deployments set the new tag in the chart's image setting.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html","publishedAt":"2026-10-02T17:33:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedVendors":[],"affectedVendorsRaw":["GitLab AI Gateway","GitLab Duo Agent Platform"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-02T17:33:31.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}