GitLab AI Gateway RCE: A Critical Reminder of AI Infrastructure Security Gaps

GitLab has issued an urgent advisory regarding a critical remote code execution (RCE) vulnerability, CVE-2026-90970, affecting its self-hosted AI Gateway. The flaw, rated with a CVSS score of 9.9, enables authenticated users with basic privileges and Duo Agent Platform access to escape the prompt template sandbox and execute arbitrary commands on unpatched instances. GitLab has released patched versions (19.2.4, 19.3.2, and 19.4.1) to address this issue, emphasizing the immediate need for self-hosted deployments to update. Cloud-hosted GitLab AI Gateway instances are reportedly already protected. This vulnerability is a stark reminder for DevSecOps practitioners that the security perimeter in AI-driven development extends beyond the AI models themselves to the underlying infrastructure. The ability for an authenticated user to achieve RCE through a crafted flow configuration in the AI Gateway demonstrates that even components designed to facilitate AI integration can introduce severe risks. The incident underscores the critical importance of securing every layer of the AI stack, from data input and processing to the execution environment. Organizations heavily relying on GitLab's AI Gateway for their AI-native features, particularly those with self-hosted deployments, are directly impacted and face immediate operational risks if not patched promptly. This incident is not an isolated event but rather fits into a broader, well-established trend of vulnerabilities emerging in AI-specific infrastructure components. Notably, this is the second critical flaw (CVE-2026-1868 being the first in February 2026) in the same GitLab AI Gateway component this year, both classified under CWE-1336 (improper neutralization of special elements in template engines). This pattern highlights a systemic challenge in ensuring robust security for AI systems that rely on template engines for processing user inputs. The increasing sophistication of AI agents and their integration into critical workflows, as seen with other recent incidents involving AI agents escaping sandboxes and accessing sensitive data, further amplifies the need for proactive security measures. In practice, this means that organizations operating self-hosted GitLab AI Gateways must prioritize immediate patching to the recommended versions. Beyond patching, practitioners should conduct a thorough review of their Duo Agent Platform access controls, ensuring that only necessary personnel have the required privileges. It's crucial to adopt a "zero-trust" mindset for AI infrastructure, assuming that any user-supplied input or configuration could be malicious. Continuous monitoring of AI Gateway activity for anomalous behavior and regular security audits of all AI-related components are no longer optional but essential. The trade-off here is between the rapid adoption of AI capabilities and the foundational security principles that must underpin them. Ignoring these infrastructure-level vulnerabilities can lead to significant data breaches, system compromise, and reputational damage.