GitLab patches a second CVSS 9.9 template-sandbox escape in its AI Gateway in eight months

GitLab's February fix for CVE-2026-1868 shipped in AI Gateway 18.6.2, 18.7.1 and 18.8.1, in a patch release dated February 6, according to a dev.to write-up that checked both advisories against each other ^[12]. October's advisory lists self-hosted builds 18.1.6 through 19.2.3 as affected, along with 19.3.0 to 19.3.1 and 19.4.0 ^[5]. All three February builds fall inside that first range ^[20]. GitLab's own version list therefore shows the October bug was already present in the builds that carried the February fix ^[20].

The attack path is short. A user with Duo Agent Platform access submits a crafted flow configuration ^[4]. The gateway expands it inside its prompt-template sandbox. Inadequate sanitization then lets the payload out to run commands on the gateway host or container ^[4]. The vector string matches that description: network-reachable, low complexity, low privileges, no user interaction ^[2]. GitLab's advisory says only "prompt template sandbox" and cites CWE-1336, improper neutralization of special elements in a template engine ^[17][3]. According to the same write-up, the claim that the engine uses Jinja2-style placeholders comes from secondary coverage, not from GitLab ^[17].

February's repair was a sandbox repair. A third-party PoC verification report, cited in the same analysis, traces CVE-2026-1868 to ai_gateway/prompts/base.py and shows the fix replacing a weaker sandbox with a class called PromptSandboxedEnvironment ^[18]. GitLab's October advisory does not mention the February flaw. So the public record does not say whether the new escape defeats that class or gets around it ^[15].

The advisory wording barely changed. In February GitLab wrote of "insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions" ^[13]. In October it wrote of escaping "the prompt template sandbox via a specially crafted flow configuration" ^[14]. Both advisories give the same CVSS string, "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", character for character ^[2][11].

GitLab handled the disclosure well. GitLab.com, GitLab Dedicated and self-managed instances that point at GitLab-hosted gateways were remediated before the advisory and need no action ^[6]. GitLab also contacted self-hosted gateway customers directly before going public ^[19]. That leaves self-hosted gateways as the exposed set. In those deployments every GitLab AI request, including code suggestions, chat and Duo Agent Platform flows, passes through the box an attacker would own ^[9].