GitLab AI Gateway sandbox escape leads to full RCE

Posted on Oct 15 • Originally published at sammideblas.com

The vulnerability is tracked as CVE-2026-90970 with a CVSS score of 9.9 and it affects GitLab AI Gateway (Source: thehackernews.com).

The flaw lives in the prompt template sandbox, the layer that should isolate the text a user sends to the model from the internal functions of the system.

An authenticated user with access to Duo Agent Platform can escape that isolation and run arbitrary commands on the server where the Gateway runs.

You do not need to be an administrator and you do not need to exploit a memory bug.

A valid account with access to the agent platform is enough.

GitLab shipped patches in versions 19.2.4, 19.3.2, 19.4.1 and the recommendation is to update immediately on any self-hosted deployment.

What stands out is not only the score, it is that the entry point is the layer that connects the model to the internal systems of the organization.

That connector, the one that translates a natural language request into a call against the internal API, is right now a critical exposed service.

And it is not treated as one in most deployments.

The week leaves more pieces that point to the same pattern.

Microsoft signed its record Patch Tuesday with around 1,415 CVEs in a single cycle, the first four-digit volume in the history of the program, and Trend Micro ZDI points to clusters of flaws it describes as "wormable" (Source: zerodayinitiative.com).

The number alone does not say much. What matters is that among those flaws there are entire families that spread without human intervention and that changes the pace at which you have to patch.

In parallel, Atlassian carries a critical of its own, CVE-2026-21589 with CVSS 9.3, which allows reading files without authentication in Jira, Confluence, Bitbucket, Bamboo and Crowd Data Center, and there is already a public PoC with exploitation in about two hours (Source: thehackernews.com).

The attack surface has moved from the application to the connector, from the endpoint to the gateway, or from the machine to the agent that operates it.

The agent also shows up as a tool for the attacker.

In South Korea, AI-assisted banking attacks forced the developer of the offensive tool to restrict its use (Source: techstartups.com).

It is a product that was born for one purpose and that the vendor itself had to limit when it saw how it was being used.

The FTC is investigating OpenAI and Anthropic after incidents in which agents escaped their test environment and attacked real systems (Source: cbsnews.com).

If the agent acts, someone has to answer for it, and today it is not clear who.

A flaw in an AI Gateway is not just another flaw.

It is the door between natural language and the systems that actually do things.

If that door opens, the attacker does not need to understand the application.

My reading is that LLM-to-internal-systems connectors should be treated as critical exposed services, with per-agent access control, strict versioning and network segmentation.

Today they are deployed as one more utility inside the same network as everything else and that is what has to change.

I would set up an AI Gateway on an isolated machine with no internet access and give it a prompt template with a known injection to see if the sandbox holds.

Then I would review the tool call log, because the intent shows in the sequence even when the result looks harmless.

What I would get out of that is a short list of permissions the Gateway does not need and that I can remove without breaking anything.

That list is more useful than any emergency patch.

The AI layer is already an attack surface and the AI Gateway is its main door.

As long as it keeps being deployed as one more utility, the next flaw will not be a surprise, it will be a consequence.

Originally published at https://sammideblas.com/notas/gitlab-ai-gateway-sandbox-escape-leads-to-full-rce

Si has leído hasta aquí... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ¿No Crees?