# The Gateway Image Moved. The Signing Keys Did Not. > The primary is GitLab CVE-2026-90970, published 2 October 2026 at 14:34 UTC. An authenticated Duo Agent Platform user can escape the prompt-template sandbox on a self-hosted AI Gateway and run commands there. Fixed images are 19.2.4, 19.3.2, and 19.4.1. GitLab-hosted gateways are already patched. The image tag does not rotate the RSA signing keys that service holds. Source: https://hackerlogs.com/blog/gitlab-cve-2026-90970 Published: 2026-10-02 ## Key takeaways - The primary is CVE-2026-90970, published 2 October at 14:34 UTC. CVSS 9.9, CWE-1336, scope changed. The finder credit on the record is invisiblemeerkat. - Only a self-hosted AI Gateway has to move. GitLab.com, Dedicated, and self-managed instances that use a GitLab-hosted gateway are already covered. - Fixed tags are 19.2.4, 19.3.2, and 19.4.1. The affected range starts at 18.1.6, so the February images for CVE-2026-1868 sit inside it. - CISA's ADP note at 16:47 UTC says Exploitation none, Automatable no, and Technical Impact total. The advisory lists no workaround and no detection check. - The install guide puts two RSA 2048 signing pairs in the gateway environment and says to treat them as sensitive credentials. A new image does not replace those keys. On 2 October at 14:34 UTC GitLab published [CVE-2026-90970](https://www.cve.org/CVERecord?id=CVE-2026-90970). An authenticated user with Duo Agent Platform access can escape the prompt-template sandbox on a self-hosted AI Gateway and run commands on that gateway. The fixed images are 19.2.4, 19.3.2, and 19.4.1. GitLab-hosted gateways were already patched before the post. Hacker News on 2 October led with Zig 0.17, a telescope sequence, and Flux 3. US X trends were football, fashion week, and politics. Sites in ChatGPT and Flux 3 are launches. Reuters' last agent story in this window was a failed probe of a Canadian library site, with no confident vendor attribution. The operator record is the gateway advisory. Self-hosted AI Gateway, Duo Agent flow, command execution where the JWT signing keys live. Critical because the record scores 9.9 with scope changed, not because an in-the-wild attack has been named. Three panels for the GitLab AI Gateway advisory: a Duo Agent flow leaving the prompt-template sandbox, a self-hosted-only 9.9 with the February fix still inside the range, and two RSA signing pairs the new image does not rotate. ## Who has to move. The product is the GitLab AI Gateway, not GitLab CE or EE. The [patch post](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/) covers every gateway from 18.1.6 before 19.2.4, every 19.3 build before 19.3.2, and every 19.4 build before 19.4.1. CVSS 3.1 is 9.9, vector `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. Privileges required are low. User interaction is none. Scope is changed, which is why this is 9.9 rather than a contained 8.8. You are in scope only if you run that gateway yourself. GitLab says a fix is already deployed for GitLab-hosted AI Gateways. GitLab.com, GitLab Dedicated, and self-managed instances that use a GitLab-hosted gateway do not need to act. The precondition is an authenticated user who can use Duo Agent Platform. The advisory title is an improper neutralization issue in a custom flow prompt template. GitLab's sentence, which this brief does not expand, is that a specially crafted flow configuration could escape the prompt template sandbox and lead to arbitrary command execution on the AI Gateway. The conditions are not listed. No role is named beyond that access. [BleepingComputer](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/) and [The Hacker News](https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html) both ran that sentence on 2 October. > On 6 February GitLab shipped 18.6.2, 18.7.1, and 18.8.1 for [CVE-2026-1868](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-18-8-1-released/). That was also CWE-1336, also a 9.9, also a crafted Duo Agent Platform flow, also code execution on the gateway. GitLab found that one internally. Those three tags sit inside today's range, which opens again at 18.1.6. The February image did not close this CVE. ## The package clock and the impact clock. The package clock is the public record. GitLab reserved CVE-2026-90970 on 14 September at 13:37 UTC. It published the record on 2 October at 14:34 UTC, with the solution to upgrade to 19.2.4, 19.3.2, 19.4.1, or above. The patch post says GitLab had already sent that guidance to self-hosted gateway customers. It does not date the outreach. Eighteen days is the gap between reservation and the public label, not a measured customer-notice clock. The [install guide](https://docs.gitlab.com/install/install_ai_gateway/) is the impact clock. A self-hosted gateway must hold two RSA 2048-bit PEM pairs and receive them as environment variables. One pair signs tokens for Duo Chat and Code Suggestions. The other signs tokens for the Duo Agent Platform service. The guide says to keep the files secure and treat them as sensitive credentials. The signing key signs what the service issues. The validation key is how a previous signing key keeps working until those tokens expire. That is the designed rotation. It is also why a new image tag does not end the incident. The process the advisory says can run commands is the process that holds the keys. CISA's ADP entry on the same CVE record, timestamped 16:47 UTC on 2 October, sets Exploitation to none, Automatable to no, and Technical Impact to total. None is not a detection result from your gateway. The advisory publishes no workaround and no way to check whether a flow you did not author already ran. > A patched container that still mounts yesterday's key files has finished the package clock and left the impact clock running. The image is current. The credential is not. ## What this is not. It is not [CVE-2026-85706](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/). That September bug is unauthenticated file read on self-managed CE and EE. Patching the Git host does not patch the AI Gateway image, and the gateway has its own tag. It is not a GitLab.com incident. Hosted gateways are the estate GitLab says it already fixed. It is not a confirmed intrusion. CISA's assessment says exploitation none. The advisory does not describe an attack in the wild. Absence of a named victim is not a reason to leave the signing keys in place on a gateway that was in the affected range. It is not a finding against the model weights. The weakness class on the record is CWE-1336, improper neutralization in a template engine. The sandbox in the advisory is the prompt template sandbox, and the impact GitLab names is command execution on the gateway. ## What to do. 1. List self-hosted AI Gateway installs. If the instance uses a GitLab-hosted gateway, stop. GitLab.com and Dedicated are in that stopped set. 2. Read the running image tag. The install guide says a GitLab vX.Y line takes the latest `self-hosted-vX.Y` tag, not a newer minor you have not moved the application to. The fixed tags in this advisory are 19.2.4, 19.3.2, and 19.4.1. A gateway still on 18.x or 19.1 has no fixed tag on its own line. 3. Upgrade that image before you treat the ticket as closed. There is no listed workaround. Until the tag is current, remove Duo Agent Platform access from anyone who does not need to author flows. That shrinks the precondition. It does not fix the template. 4. Rotate both RSA pairs after the new image is up. Generate new keys, pass them in, and do not leave the pre-patch signing key in the validation role if you cannot show the gateway never ran a flow you did not author. The install guide keeps the previous key valid on purpose during a normal rotation. Suspicion is not a normal rotation. 5. Review any other secret mounted into that container, including a credential used to reach a model provider. The advisory does not inventory them. The install guide does inventory the JWT pairs. The package clock stopped at 14:34 UTC for anyone who could pull 19.2.4, 19.3.2, or 19.4.1. The signing keys, if they were readable, are still on the impact clock. ## Sources - [GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/) (2026-10-02) - [CVE-2026-90970](https://www.cve.org/CVERecord?id=CVE-2026-90970) (2026-10-02) - [Install the GitLab AI Gateway](https://docs.gitlab.com/install/install_ai_gateway/) - [GitLab AI Gateway Critical Patch Release: 18.6.2, 18.7.1, and 18.8.1](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-18-8-1-released/) (2026-02-06) - [GitLab warns of critical RCE vulnerability in AI Gateway service](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/) (2026-10-02) - [GitLab Patches Critical Self-Hosted AI Gateway Flaw That Could Let Duo Agent Users Run Commands](https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html) (2026-10-02)