CriticalVulnerability
CVE-2026-1868: GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-1868
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.7%
Summary
GitLab fixed CVE-2026-1868 in the Duo Workflow Service component of GitLab AI Gateway, which affected versions 18.1.6, 18.2.6, 18.3.1 through 18.6.1, 18.7.0, and 18.8.0. The flaw is insecure template expansion of user-supplied data through crafted Duo Agent Platform Flow definitions. Exploitation could cause a Denial of Service or code execution on the Gateway.
Mitigation
Fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway.
Coverage
News, research and other items that mention CVE-2026-1868.
- GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted ServersThe Hacker News · 2026-10-02
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online