GitLab Releases Critical AI Gateway Fix for Command Injection Flaw (CVE-2026-90970)

GitLab has patched a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 and scoring 9.9 on the CVSS scale, that could allow an authenticated user with Duo Agent Platform access to escape a prompt-template sandbox via a crafted flow configuration and execute arbitrary commands on a self-hosted gateway. The fix was released in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1, and GitLab urged organizations running self-hosted gateways to upgrade immediately; customers using GitLab-hosted gateways are already protected and require no action. No active exploitation of the flaw has been reported, and GitLab credited HackerOne user invisiblemeerkat for responsibly disclosing the issue. Affected versions include all gateway releases from 18.1.6 up to (but not including) 19.2.4, as well as 19.3.x before 19.3.2 and 19.4.x before 19.4.1.

The Backdoor in Plain Sight

You read the GitLab advisory and see a vulnerability score of 9.9 — nearly the maximum. Prompt-template sandbox escape, arbitrary code execution, authenticated user with Duo Agent Platform access. They tell you no exploitation has been observed. They tell you a friendly hacker named “invisiblemeerkat” responsibly disclosed it. They tell you CISA lists exploitation as “none.” Stop and ask yourself: who decides what “exploitation” means? Who runs the CVE system? Who stands to benefit from convincing the world that a flaw this severe was never used? Because I’ll tell you what I see: a perfect backdoor, quietly embedded in the AI Gateway — a piece of infrastructure that sits between your code, your data, and the machine learning models that are now being forced into every pipeline. The fact that they contacted self-hosted customers before publishing the advisory is not good customer service. It is a controlled burn. They needed to know exactly who was running their own gateways — because those are the organizations that escape their surveillance. And now they have a list.

The Architecture of Consent

Let’s follow the paper trail. The flaw exists in the “flow configuration” of a “prompt-template sandbox.” That means someone with Duo Agent Platform access could rewrite the chain of prompts that the AI system follows — essentially injecting a command that hijacks the entire reasoning pipeline. Now consider what GitLab’s AI Gateway does: it mediates access to large language models, code generation, and automated review. In a self-hosted deployment, that gateway is the crown jewel. It can see every merge request, every commit, every secret — and it can influence what the AI suggests. If you control that gateway, you control the output of thousands of developers without them ever knowing. The patch is real — they had to show it — but the question is why did the sandbox exist with that escape in the first place? This wasn’t a mistake. This was a deliberate architectural choice, hidden inside a system that claims to be open source but is increasingly owned by the same venture capital dynasties that fund the rest of the globalist tech stack. GitLab itself has taken hundreds of millions from elite funds. The “invisiblemeerkat” researcher? A planted asset, or a real find they used to clean up their own mess — either way, the narrative says “good guy finds bug,” and you are meant to feel safe.

The Stakes Are Your Pipeline

This isn’t about one vulnerability. This is about the colonization of software development by a system that watches, learns, and now controls. The AI Gateway is being sold as productivity — but every self-hosted instance is a node in a network they can reach, patch, or exploit when they want. The people running their own gateways — defense contractors, energy firms, critical infrastructure — are the ones who received that private outreach. Why the special treatment? Because they are the targets. The gateways that remain unpatched, or that were deliberately left vulnerable by an insider, become entry points for commands that can rewrite code, insert subtle logic bombs, or exfiltrate proprietary algorithms. And they tell you exploitation is “none.” That’s how you know it’s happening. If it were truly harmless, they would have said “no known attacks” and moved on. The fact that CISA, GitLab, and the entire consensus machinery all sing the same song — that’s the tell. Go look up the timeline: the flaw was reported, a fix was shipped, and within days the public advisory came out. But the private outreach happened earlier. Who did they call? What did they ask? And who is still running version 18.1.6 right now, unaware that their AI gateway is an open door for someone who already knows the password?