GitLab patches a critical SI gateway vulnerability (9.9 out of 10): a flow template can be used to run a command on customers' own servers
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Infrastructure for SI agents is an ordinary target for attacks, and holes in it get patched as fast as in any software.
Vulnerability CVE-2026-90970 lets an authorized user with access to the Duo Agent Platform escape the prompt-template sandbox through a specially crafted flow configuration and execute an arbitrary command on a self-hosted gateway. Versions 18.1.6 to 19.4.0 are affected; fixes are in 19.2.4, 19.3.2 and 19.4.1; GitLab.com and GitLab-managed installations are not affected. Compromising the gateway exposes JWT signing keys and connections to model providers; no cases of exploitation had been recorded at the time of publication.
Sources 1