The Gateway Image Moved. The Signing Keys Did Not.

On 2 October at 14:34 UTC GitLab published CVE-2026-90970. An authenticated user with Duo Agent Platform access can escape the prompt-template sandbox on a self-hosted AI Gateway and run commands on that gateway. The fixed images are 19.2.4, 19.3.2, and 19.4.1. GitLab-hosted gateways were already patched before the post.

Hacker News on 2 October led with Zig 0.17, a telescope sequence, and Flux 3. US X trends were football, fashion week, and politics. Sites in ChatGPT and Flux 3 are launches. Reuters' last agent story in this window was a failed probe of a Canadian library site, with no confident vendor attribution. The operator record is the gateway advisory.

Critical Self-hosted AI Gateway, Duo Agent flow, command execution where the JWT signing keys live. Critical because the record scores 9.9 with scope changed, not because an in-the-wild attack has been named.

Who has to move.#

The product is the GitLab AI Gateway, not GitLab CE or EE. The patch post covers every gateway from 18.1.6 before 19.2.4, every 19.3 build before 19.3.2, and every 19.4 build before 19.4.1. CVSS 3.1 is 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Privileges required are low. User interaction is none. Scope is changed, which is why this is 9.9 rather than a contained 8.8.

You are in scope only if you run that gateway yourself. GitLab says a fix is already deployed for GitLab-hosted AI Gateways. GitLab.com, GitLab Dedicated, and self-managed instances that use a GitLab-hosted gateway do not need to act.

The precondition is an authenticated user who can use Duo Agent Platform. The advisory title is an improper neutralization issue in a custom flow prompt template. GitLab's sentence, which this brief does not expand, is that a specially crafted flow configuration could escape the prompt template sandbox and lead to arbitrary command execution on the AI Gateway. The conditions are not listed. No role is named beyond that access. BleepingComputer and The Hacker News both ran that sentence on 2 October.

The package clock and the impact clock.#

The package clock is the public record. GitLab reserved CVE-2026-90970 on 14 September at 13:37 UTC. It published the record on 2 October at 14:34 UTC, with the solution to upgrade to 19.2.4, 19.3.2, 19.4.1, or above. The patch post says GitLab had already sent that guidance to self-hosted gateway customers. It does not date the outreach. Eighteen days is the gap between reservation and the public label, not a measured customer-notice clock.

The install guide is the impact clock. A self-hosted gateway must hold two RSA 2048-bit PEM pairs and receive them as environment variables. One pair signs tokens for Duo Chat and Code Suggestions. The other signs tokens for the Duo Agent Platform service. The guide says to keep the files secure and treat them as sensitive credentials. The signing key signs what the service issues. The validation key is how a previous signing key keeps working until those tokens expire. That is the designed rotation. It is also why a new image tag does not end the incident. The process the advisory says can run commands is the process that holds the keys.

CISA's ADP entry on the same CVE record, timestamped 16:47 UTC on 2 October, sets Exploitation to none, Automatable to no, and Technical Impact to total. None is not a detection result from your gateway. The advisory publishes no workaround and no way to check whether a flow you did not author already ran.

1. 2026-02-06
   CVE-2026-1868 fixed in AI Gateway 18.6.2, 18.7.1, and 18.8.1. Same CWE-1336 and the same 9.9 vector. Internal discovery.
2. 2026-09-14
   13:37 UTC: CVE-2026-90970 reserved. A reservation is not a public advisory and not a dated customer notice.
3. 2026-10-02
   14:34 UTC: record published. Fixed tags 19.2.4, 19.3.2, and 19.4.1. Outreach to self-hosted customers already sent, with no date on the post. 16:47 UTC: CISA ADP sets Exploitation to none and Technical Impact to total.

What this is not.#

It is not CVE-2026-85706. That September bug is unauthenticated file read on self-managed CE and EE. Patching the Git host does not patch the AI Gateway image, and the gateway has its own tag.

It is not a GitLab.com incident. Hosted gateways are the estate GitLab says it already fixed.

It is not a confirmed intrusion. CISA's assessment says exploitation none. The advisory does not describe an attack in the wild. Absence of a named victim is not a reason to leave the signing keys in place on a gateway that was in the affected range.

It is not a finding against the model weights. The weakness class on the record is CWE-1336, improper neutralization in a template engine. The sandbox in the advisory is the prompt template sandbox, and the impact GitLab names is command execution on the gateway.

What to do.#

1. List self-hosted AI Gateway installs. If the instance uses a GitLab-hosted gateway, stop. GitLab.com and Dedicated are in that stopped set.
2. Read the running image tag. The install guide says a GitLab vX.Y line takes the latest self-hosted-vX.Y tag, not a newer minor you have not moved the application to. The fixed tags in this advisory are 19.2.4, 19.3.2, and 19.4.1. A gateway still on 18.x or 19.1 has no fixed tag on its own line.
3. Upgrade that image before you treat the ticket as closed. There is no listed workaround. Until the tag is current, remove Duo Agent Platform access from anyone who does not need to author flows. That shrinks the precondition. It does not fix the template.
4. Rotate both RSA pairs after the new image is up. Generate new keys, pass them in, and do not leave the pre-patch signing key in the validation role if you cannot show the gateway never ran a flow you did not author. The install guide keeps the previous key valid on purpose during a normal rotation. Suspicion is not a normal rotation.
5. Review any other secret mounted into that container, including a credential used to reach a model provider. The advisory does not inventory them. The install guide does inventory the JWT pairs.

The package clock stopped at 14:34 UTC for anyone who could pull 19.2.4, 19.3.2, or 19.4.1. The signing keys, if they were readable, are still on the impact clock.