GitLab has released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1 to address CVE-2026-90970. The advisory says an authenticated user with Duo Agent Platform access could, under certain conditions, escape a prompt-template sandbox and execute commands on the gateway.
The listed affected ranges are 18.1.6 up to, but excluding, 19.2.4; 19.3 up to 19.3.2; and 19.4 up to 19.4.1. The upper version in each range is patched. GitLab urges affected self-hosted installations to update. It says GitLab-hosted gateways are already protected, including those used by self-managed GitLab instances. The advisory does not establish active exploitation.
NAOAT analysis: Identify the component before closing the patch ticket
The useful operational distinction is where the gateway runs. An organization can operate its own main development platform while relying on a separately hosted AI service. Conversely, a team may have installed an additional gateway whose update process is outside the main application’s routine maintenance. An inventory entry should make that responsibility explicit.
A focused review would identify the running gateway version, the team responsible for it and the users allowed to configure agent workflows. That review should cover development and staging installations as well as the production service. An unused instance can still hold credentials or reach internal resources.
After updating, record the deployed version and check a representative authorized workflow. Restarting a service or changing a deployment file is not the same as confirming that every running instance uses the intended software. If there are multiple replicas, the completion record should cover them all.
This disclosure also offers a broader lesson for AI adoption: supporting services need ordinary software ownership. Assigning an accountable maintainer, an update path and an inventory record makes it easier to respond when a vendor announces a narrowly scoped issue. Those basics remain useful regardless of how sophisticated the model behind the service becomes.