GitLab AI Gateway CVE-2026-90970: "SSTI Wearing an AI Costume"

张读书 — Fri, 09 Oct 2026 06:13:17 +0000

Disclosed: 2026-10-02. Sources: BleepingComputer (advisory quoted verbatim), The Hacker News, aiweekly, cyberpress, SecurityAffairs, ThaiCERT, dev.to/cortexflow_tech (patch guide), dennysentinel, forkast, labs.cosmicbytez. February CVE cross-checked against GitLab's own Feb 6, 2026 AI Gateway patch release (Greg Myers; text verified via archived mirror).
TL;DR
On October 2, GitLab disclosed CVE-2026-90970: a CVSS 9.9 sandbox escape in the AI Gateway's custom-flow prompt templates that lets an authenticated Duo Agent Platform user run arbitrary commands on the gateway. The uncomfortable part isn't the score — it's the déjà vu. Eight months earlier, GitLab patched CVE-2026-1868 in the same component, same CVSS 9.9, same CVSS vector, same weakness class (CWE-1336), via the same attack surface (a crafted Duo Agent Platform flow definition). They patched the hole in February. In October the sandbox broke again. And the exploit primitive isn't AI at all — it's server-side template injection, the vulnerability class backend engineers were patching a decade ago, now wearing an AI costume.
The vulnerability (verified facts)
CVE-2026-90970, CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, low privileges, no user interaction, changed scope, full C/I/A impact.
Weakness: CWE-1336 — improper neutralization of special elements in a template engine.
Mechanism: an authenticated user with Duo Agent Platform access submits a specially crafted flow configuration; inadequate sanitization lets it escape the prompt-template sandbox, yielding arbitrary command execution on the AI Gateway host/container.
Affected: self-hosted AI Gateway 18.1.6–19.2.3, 19.3.0–19.3.1, 19.4.0. Fixed: 19.2.4, 19.3.2, 19.4.1 (released Oct 2).
Scope: self-hosted gateways only. GitLab.com, GitLab Dedicated, and self-managed instances pointed at GitLab-hosted gateways were already remediated — no customer action needed.
Disclosure: reported via HackerOne by researcher invisiblemeerkat; GitLab did targeted outreach to self-hosted gateway customers before the public advisory.
Exploitation status: no public PoC, no known in-the-wild exploitation (CISA: none, as of Oct 2). No workaround exists.
Why the gateway is the wrong box to lose
The AI Gateway is the proxy every GitLab AI request passes through — code suggestions, chat, Duo Agent Platform flows. A self-hosted gateway is a trusted intermediary that holds JWT signing keys for GitLab↔gateway communication and maintains connections to both the internal GitLab instance and the organization's model providers. Command execution there isn't just a foothold; it's the signing keys and the traffic. Scope "changed" in the CVSS vector is doing real work here.
Twice in eight months: the comparison that writes itself

CVE-2026-1868 (Feb 2026)
CVE-2026-90970 (Oct 2026)
Component
AI Gateway, Duo Workflow Service
AI Gateway, custom-flow prompt templates
CVSS
9.9
9.9
Vector
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-1336
CWE-1336
Attack surface
Crafted Duo Agent Platform flow definition
Crafted Duo Agent Platform flow configuration
Impact
DoS or code execution on the gateway
Arbitrary command execution on the gateway
Fixed in
18.6.2 / 18.7.1 / 18.8.1
19.2.4 / 19.3.2 / 19.4.1
The February advisory (GitLab's own release post) described "insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions." The October advisory describes escaping "the prompt template sandbox via a specially crafted flow configuration." Different words, same sentence. The October advisory does not mention the February flaw.
The technical angle: SSTI, not prompt injection
This is the detail that makes the story land with a backend audience: the injection fires in the template engine, before any LLM is ever invoked. It is a server-side code-execution path, not an AI prompt-injection attack. Secondary technical write-ups (aiweekly, forkast, aiunderstanding) identify the engine as Jinja2-style placeholders; the official advisory itself only says "prompt template sandbox" and CWE-1336, so attribute the Jinja2 naming accordingly.
There is a sharper data point from third-party analysis of the February CVE: a public PoC verification report traces it to ai_gateway/prompts/base.py and shows the fix introduced a PromptSandboxedEnvironment to replace the weaker sandbox. Read that plainly: in February, GitLab hardened the template sandbox. In October, the sandbox was escaped again through the same flow-definition surface. The patch fixed the instance; the design assumption — user-authored flow configs rendered by a template engine on trusted infrastructure — survived untouched.
Operational gotchas worth one paragraph
The AI Gateway is a separately versioned component. Upgrading core GitLab CE/EE does not remediate this; operators must update the gateway image/Helm chart directly. Multiple outlets flag this as the likeliest reason someone stays exposed.
There is no workaround, and GitLab's advisory offers no way to determine whether a gateway was compromised before patching (THN). The update is the only remediation.
The privilege bar is structural, not administrative: exploitation needs only the ability to author or edit a flow — not admin rights. Instances that let broad developer populations build custom Duo flows have a larger practical attack surface than "authenticated" suggests.
Suggested blog angles (pick one)
(a) "Patched the hole, not the thinking." Two 9.9s, eight months apart, identical vector, identical weakness class, identical attack surface — the recurrence is the editorial. Sandboxes around template engines are a 2015-era problem (SSTI has its own OWASP-era lore); bolting one onto an AI agent platform without rethinking who gets to author executable templates is how you get the same CVE twice. Connects directly to the Mods brief's "no sandbox ≈ handing out root" line — this time the vendor proved it against itself.
(b) "SSTI wearing an AI costume" — the backend-developer resonance piece. Everything about the triage looks like AI security (prompt templates, agent platform, LLM gateway) and nothing about the exploit is AI security. For a Java/backend audience, that's the hook: the vulnerability class they fixed in their Spring/Thymeleaf apps a decade ago is now the thing breaking AI infrastructure. Pairs with the Mods/CVP material as an "AI-era dev-tool supply-chain security" mini-series.
What's unverified / handle with care
GitLab's official patch-release page text was verified only through verbatim quotes reproduced identically across BleepingComputer, SecurityAffairs, The Hacker News, and others — the page itself did not render in text fetch. Treat advisory wording as reported-by-outlets.
The "Jinja2" engine naming comes from secondary technical analysis (aiweekly, forkast, aiunderstanding), not from GitLab's advisory, which says only "prompt template sandbox" / CWE-1336.
The February PoC detail (base.py, SandboxedEnvironment → PromptSandboxedEnvironment) is from a third-party GitHub PoC verification repo, not from GitLab.
No PoC and no known exploitation as of Oct 2–3 reporting; that can change — recheck before publishing.

DEV Community: 张读书

GitLab AI Gateway CVE-2026-90970: "SSTI Wearing an AI Costume"