Executive Summary
GitLab patched a critical CVSS 9.9 flaw in its AI Gateway that lets a logged-in user with Duo Agent Platform access run commands on self-hosted gateways; fixed in 19.2.4, 19.3.2 and 19.4.1.
What Happened
A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. The flaw
Affected Products
- GitLab AI Gateway
- GitLab Duo Agent Platform
Vulnerability / Attack Technique
Command execution on the AI gateway by an authenticated user
Technical Mechanism
Under certain conditions, a user with Duo Agent Platform access can run commands on the gateway service that connects GitLab to AI models.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
The gateway brokers all AI model traffic for the instance, so command execution there is high impact. RealGround analysis: AI gateways are critical infrastructure and need the same patch urgency as the main app.
Recommended Controls
- Upgrade self-hosted AI Gateway to 19.2.4, 19.3.2 or 19.4.1
- Limit Duo Agent Platform access to users who need it
- Isolate the AI gateway host and monitor its process activity
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.