GitLab patches sandbox escape that lets Duo agent users run commands on self-hosted AI Gateways

GitLab's Friday advisory ^[9] said the flaw "under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway" ^[3]. The attacker's input is a flow configuration, submitted with access the attacker already holds ^[3]. Those commands run on the gateway, the service that gives access to GitLab Duo's AI features ^[5].

Only part of GitLab's user base is exposed. GitLab reports more than 30 million registered users and use at over half of the Fortune 100 ^[13]. Its own cloud gateway serves GitLab.com, Self-Managed and Dedicated customers. The vulnerable installs are the separate gateways that Self-Managed customers deploy themselves through GitLab Duo Self-Hosted ^[5]. BleepingComputer's report does not say how many such gateways exist, or that CVE-2026-90970 has been exploited ^[10].

For operators who do run one, the instruction is to upgrade now. "These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately," the company said ^[7].

Last month's critical is the comparison point. CVE-2026-85706, a maximum-severity path traversal in GitLab Community and Enterprise Edition, let unauthenticated attackers read credentials and other secrets from servers ^[11]. CISA added it to its actively exploited list under BOD 26-04 ^[12]. That bug needed no login. This one needs a logged-in user with agent access ^[3]. In return it gives command execution on the gateway, where last month's bug gave reads of stored secrets ^[3][11].