Skip to content
AgentProv

2026-10-02 · 2026-Q4

GitLab AI Gateway: A Crafted Duo Agent Platform Flow Escapes the Prompt-Template Sandbox and Runs Commands (CVE-2026-90970)

Primary layerL5 Config

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

Self-hosted GitLab AI Gateway, the service behind GitLab Duo and the Duo Agent Platform

Impact

GitLab released AI Gateway 19.2.4, 19.3.2, and 19.4.1 on October 2, 2026 to fix a critical flaw that lets an authenticated user with Duo Agent Platform access submit a specially crafted custom flow configuration, escape the prompt template sandbox, and execute commands on the gateway. Affected versions run from 18.1.6 through 19.2.3, 19.3 before 19.3.2, and 19.4 before 19.4.1. GitLab.com, GitLab Dedicated, and self-managed instances that use GitLab-hosted gateways were already patched; customers running their own gateway were contacted before release. No exploitation was reported. Found by HackerOne researcher invisiblemeerkat

Root cause

User-authored agent flow definitions are rendered through a template engine on the server that holds the model provider credentials, and the template sandbox did not neutralize the input (CWE-1336). The same component class had a CVSS 9.9 flaw earlier in 2026

CVE

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: GitLab AI Gateway: A Crafted Duo Agent Platform Flow Escapes the Prompt-Template Sandbox and Runs Commands (CVE-2026-90970) (2026-10-02). https://agentprov.com/incidents/2026-10-02-gitlab-ai-gateway-a-crafted-duo-agent-platform-flow-escapes-the-prompt-template

Related