Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitLab Self-Hosted AI Gateway immediate update advisory (CVE-2026-90970)

Advisory/Mitigation
First reported
Last updated
Happening score
H score 41
2 unique sources, 2 articles

Summary

Hide ▲

GitLab issued immediate update guidance for GitLab Self-Managed customers running Self-Hosted AI Gateway after fixing CVE-2026-90970, a flaw that could allow arbitrary command execution on unpatched instances. The company released 19.2.4, 19.3.2, and 19.4.1 and told affected users to upgrade immediately. GitLab-hosted AI Gateway users are already protected and do not need action.

Related Happenings

GitLab security patch release for CVE-2026-97229

Security Patch Release
H score37 First: 12.10.2026 16:09 Last: 12.10.2026 16:09 Sources 1

About this happening: GitLab released security fixes for GitLab CE/EE after disclosing CVE-2026-97229, and self-managed installations were told to upgrade immediately to stop possible *...

Open Happening

GitLab CI/CD Regular Expression Compiler integer overflow RCE (CVE-2026-97229)

Vulnerability
H score28 First: 12.10.2026 16:09 Last: 12.10.2026 16:09 Sources 1

About this happening: GitLab CI/CD Regular Expression Compiler flaw CVE-2026-97229 is now patched, and unpatched GitLab CE/EE servers face unauthenticated remote code execution risk. Th...

Open Happening

Atlassian Data Center products path traversal (CVE-2026-21589)

Vulnerability
H score32 First: 06.10.2026 09:58 Last: 06.10.2026 09:58 Sources 1

About this happening: Atlassian disclosed CVE-2026-21589, a path traversal vulnerability in 8 self-hosted Data Center products that can let a no-login attacker read specific files in ea...

Open Happening

GitLab security patch release for CVE-2026-90970

Security Patch Release
H score41 First: 02.10.2026 19:20 Last: 02.10.2026 19:20 Sources 1

How related: The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.

About this happening: GitLab released 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970 in GitLab Self-Hosted AI Gateway, closing a critical command-execution path for vulnerable...

Open Happening

GitLab AI Gateway improper neutralization command execution security flaw (CVE-2026-90970)

Vulnerability
H score35 First: 02.10.2026 19:20 Last: 02.10.2026 19:20 Sources 1

How related: The flaw is tracked as CVE-2026-90970. GitLab disclosed it on October 2 and rated it critical, with a CVSS score of 9.9 out of 10.

About this happening: GitLab has fixed CVE-2026-90970, a critical improper neutralization flaw in GitLab AI Gateway that could let authenticated users with Duo Agent Platform access...

Open Happening

Timeline

  1. 02.10.2026 19:20 3 articles · 11d ago

    GitLab warns customers to patch CVE-2026-90970 in AI Gateway

    Mitigation Patch Update

    GitLab warned that CVE-2026-90970 in the GitLab AI Gateway could let an authenticated user with Duo Agent Platform access escape the prompt template sandbox via a specially crafted flow configuration and execute arbitrary commands on unpatched self-hosted instances. The company released 19.2.4, 19.3.2, and 19.4.1 for GitLab Self-Hosted AI Gateway and urged GitLab Self-Managed customers to update immediately, while GitLab-hosted AI Gateway users were already protected.

    Show sources
    Open in new tab