aiqbench analysis
This critical vulnerability in GitLab's self-hosted AI Gateway exposes the underlying infrastructure processing AI requests to remote code execution via prompt injection flaws. The severity lies not in the AI model itself, but in how the gateway handles custom flow templates, potentially compromising the entire service stack if an authenticated attacker exploits the sandbox escape. Organizations relying on GitLab Duo for enterprise workflows must prioritize immediate patching to prevent unauthorized command execution within their AI processing environments.
Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks
GitLab has released urgent security updates for a critical AI Gateway vulnerability that could allow authenticated attackers to execute commands remotely. Tracked as CVE-2026-90970, the flaw carries a CVSS score of 9.9 and affects self-hosted deployments used to support GitLab Duo AI features. The company released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to address […] The post Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.
GitLab has released urgent security updates for a critical AI Gateway vulnerability that could allow authenticated attackers to execute commands remotely. Tracked as CVE-2026-90970, the flaw carries a CVSS score of 9.9 and affects self-hosted deployments used to support GitLab Duo AI features. The company released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the issue. GitLab strongly…
Excerpt shown under the publisher's RSS terms · 59 words · full text and figures are on the publisher's site
Related coverage
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
CrowdStrike Blog · Oct 13, 2026
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
CrowdStrike Blog · Sep 8, 2026
GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution
Cybersecurity News · Sep 11, 2026
CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely
Cybersecurity News · Oct 13, 2026