CVE-2026-90970

{
  "etk_id": "ETK-2026-346",
  "cve_id": "CVE-2026-90970",
  "display_id": "CVE-2026-90970",
  "ghsa_id": "GHSA-5295-vp56-jghq",
  "euvd_id": "EUVD-2026-91651",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Prompt-template sandbox escape in GitLab AI Gateway",
  "summary": "GitLab AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 are affected. An authenticated user with Duo Agent Platform access may be able to execute commands on the AI Gateway through a malicious flow configuration.",
  "mitigation": "Upgrade GitLab AI Gateway to 19.2.4, 19.3.2, or 19.4.1, as appropriate for the deployed release line. Until upgraded, restrict Duo Agent Platform access to trusted users.",
  "vendor": "GitLab",
  "product": "GitLab AI Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 18.1.6, < 19.2.4",
        ">= 19.3, < 19.3.2",
        ">= 19.4, < 19.4.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "19.2.4",
        "19.3.2",
        "19.4.1"
      ],
      "package_name": "GitLab AI Gateway",
      "purl": null
    }
  ],
  "cwes": [
    1336
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0094,
  "epss_percentile": 0.6044,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 40.5913498,
  "t0_at": "2026-10-02T14:34:49.558000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T15:12:01.618015+00:00",
      "days": 0.02583402795138889,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T14:34:49.558000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T14:34:49.558000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T14:34:49.558000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90970"
    }
  }
}