Threat
GitLab AI Gateway Sandbox Escape: Template Injection RCE – Lab Space
First reported · Discovered cloudsecurityalliance.org
Page published
Earliest dated coverage: 6 Oct 2026 · First observed: 20 Oct 2026 · Latest dated coverage: 6 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
GitLab AI Gateway's template-sandbox escape can turn low-privilege access to agent-flow configuration into server command execution, making patching affected self-hosted gateways critical.
CVE-2026-90970 allows authenticated users with GitLab Duo Agent Platform access to escape the self-hosted AI Gateway's prompt-template sandbox through crafted flow configurations and execute arbitrary commands. The reported CVSS score is 9.9, and fixes are available in versions 19.2.4, 19.3.2, and 19.4.1. GitLab-hosted gateways are reported as protected, and the reviewed sources report no evidence of active exploitation.