CVE-2026-90970

9.9 Critique

Publiée le 02/10/2026 à 17:17 · Modifiée le 02/10/2026 à 20:44 · En attente d'analyse NVD · Source : cve@gitlab.com

Description

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

Traduire en français

Produits concernés

GitLab AI Gateway

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	cve@gitlab.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-1336

Références

https://gitlab.com/gitlab-org/gitlab/-/work_items/628842

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories