GitLab Deploys Urgent Fix for AI Gateway Flaw That Enables Command Execution

GitLab announced today that it has released emergency security updates to address a critical flaw in its self‑hosted AI Gateway, identified as CVE‑2026‑90970. The vulnerability permits attackers who have valid credentials to run arbitrary system commands on the gateway server, potentially compromising the entire deployment. The issue was first disclosed by the security research collective GBHackers, prompting an immediate response from the company.

The flaw resides in the component that processes inbound AI requests and forwards them to underlying language‑model services. Because the gateway trusts authenticated sessions, a malicious actor who obtains or guesses a legitimate user token can inject crafted payloads that are interpreted as shell commands. Security analysis rates the vulnerability as high severity on the CVSS scale, reflecting the ease of exploitation and the breadth of possible impact.

GitLab’s AI Gateway is positioned as an on‑premises alternative for organizations that need to keep sensitive data behind their own firewalls while still leveraging powerful generative‑AI models. Its adoption has grown among enterprises in regulated sectors such as finance, healthcare, and government, where data residency requirements preclude the use of public‑cloud AI endpoints. The self‑hosted nature of the product means that any compromise can give attackers direct access to internal networks.

If exploited, the command‑execution capability could allow an adversary to install malware, exfiltrate confidential files, or pivot to other services running on the same host. In worst‑case scenarios, the breach could disrupt AI‑driven workflows, corrupt model outputs, or create a foothold for further lateral movement within the organization’s infrastructure. Such outcomes underscore why the vulnerability is being treated as a critical priority.

GitLab’s response includes a set of patched binaries, updated container images, and detailed remediation instructions. Customers are urged to apply the updates without delay, rotate all authentication tokens associated with the AI Gateway, and review audit logs for any suspicious activity since the vulnerability’s disclosure. The company also established a dedicated incident‑response channel to field questions from affected users and to monitor for signs of active exploitation in the wild.

The episode adds to a growing list of security challenges linked to the rapid integration of AI services into enterprise environments. Analysts note that as more organizations deploy on‑premises AI infrastructure, the attack surface expands, making rigorous code review and timely patch management essential. GitLab has pledged to continue monitoring the situation and to release any additional fixes required to safeguard its AI product suite.