A command execution vulnerability in GitLab's AI Gateway, disclosed on October 2, 2026, scored 9.9 on the CVSS scale. If you're running a self-hosted instance with Duo Agent Platform access enabled, any authenticated user could execute arbitrary commands on your gateway server.
This is a real threat. The fix is available in versions 19.2.4, 19.3.2, and 19.4.1. If you haven't patched, you're exposed.
What Happened
CVE-2026-90970 allows command execution on GitLab's AI Gateway when an authenticated user with Duo Agent Platform access sends a specially crafted request. The vulnerability affects self-hosted gateway deployments only; GitLab's managed service wasn't exposed.
The attack surface is narrower than a typical remote code execution flaw because it requires:
- Valid user credentials
- Duo Agent Platform access (not granted by default)
- Direct network access to the self-hosted gateway
Once those conditions are met, the attacker has full command execution privileges at the gateway's permission level.
Timeline
October 2, 2026: GitLab publicly disclosed CVE-2026-90970 and released patches across three version branches.
The disclosure included specific fixed versions and upgrade paths. No evidence suggests active exploitation before disclosure, but any delay in patching creates risk.
Which Controls Failed
Three control failures enabled this vulnerability:
Input validation at the gateway layer: The AI Gateway didn't properly sanitize user-supplied input before passing it to system commands. This violates basic secure coding principles; any component that processes external input must validate and sanitize before execution.
Least privilege for gateway processes: Self-hosted gateways often run with elevated permissions to simplify deployment. If your gateway runs as root or with broad system access, command execution becomes a full system compromise.
Patch deployment cadence: Organizations running self-hosted infrastructure must maintain update schedules. A 9.9 CVSS score demands emergency patching, but many teams lack defined SLAs for different severity levels.
What Standards Require
PCI DSS v4.0.1 Requirement 6.3.1 mandates that security vulnerabilities are identified and addressed based on risk rankings. A CVSS 9.9 vulnerability falls into the "critical" category, requiring remediation within defined timelines, typically 30 days for critical findings, though many organizations set internal targets of 7-14 days for this severity.
OWASP ASVS v4.0.3 Section 5.2.1 requires that all untrusted data is validated, sanitized, and escaped before use. Command injection vulnerabilities directly violate this requirement. Your input validation must occur at every trust boundary, and the AI Gateway represents a critical boundary between user input and system execution.
ISO/IEC 27001:2022 Control 8.8 addresses vulnerability management. You need documented processes for monitoring vulnerability disclosures, assessing impact against your environment, and deploying patches within risk-appropriate timeframes.
NIST 800-53 Rev 5 Control SI-2 requires flaw remediation within organization-defined time periods. For critical vulnerabilities affecting internet-facing or authentication-adjacent systems, that period should be measured in days, not weeks.
Lessons and Action Items
Build a severity-based patch SLA: Define maximum remediation times by CVSS score. For 9.0+, aim for 7 days. For 7.0-8.9, target 30 days. Document these SLAs and track compliance. When GitLab publishes a critical fix, your team should know exactly how fast you need to move.
Audit your self-hosted component inventory: List every self-hosted security or infrastructure component you run. For each, document the vendor's notification channel (security mailing list, RSS feed, GitHub watch), your update testing process, and who owns deployment. AI gateways, API gateways, authentication proxies, these components sit at critical trust boundaries and demand close monitoring.
Implement least privilege for gateway processes: Review what permissions your AI Gateway runs with. Create a dedicated service account with minimal necessary privileges. Use containerization or sandboxing to limit blast radius. If command execution occurs, it should affect only the gateway process, not your entire host.
Test your emergency patch process: Schedule a drill. Pick a non-critical system and simulate a critical vulnerability disclosure. How long does it take to:
- Verify you're affected
- Test the patch in a non-production environment
- Get change approval
- Deploy to production
- Confirm the fix
If that timeline exceeds your SLA, you need process improvements before a real emergency.
Validate input at every boundary: Review your security architecture. Where does external input enter your systems? AI gateways, API endpoints, webhook receivers, each needs explicit input validation. Don't trust that upstream components validated correctly. Defense in depth means validating at every layer.
Monitor vendor security advisories actively: Don't wait for your package manager to notify you. Subscribe to GitLab's security announcements, set up alerts for your critical vendors, and assign someone to triage daily. For self-hosted infrastructure, you own the monitoring responsibility.
The 9.9 score reflects reality: authenticated users shouldn't execute arbitrary commands on your infrastructure. If you're running affected versions, patch now. If you're evaluating self-hosted AI infrastructure, factor in the operational overhead of maintaining security updates. That overhead is real, measurable, and non-negotiable.
