GitLab patches critical 9.9 AI Gateway flaw allowing command execution on self-hosted servers
AI gateways are a new class of infrastructure that many asset inventories and patch cycles do not yet cover, and they sit close to source code and developer credentials. With no workaround available, organisations that chose self-hosting for data control now have to patch quickly. The absence of known exploitation leaves a window that should be used before that status changes.
What Happened
GitLab fixed CVE-2026-90970, a critical flaw rated 9.9 in its AI Gateway that allows command execution on self-hosted servers. The flaw affects versions from 18.1.6 and is fixed in 19.2.4, 19.3.2 and 19.4.1, and no workaround is listed for gateways that cannot yet be updated. Customers on GitLab.com, GitLab Dedicated and self-managed instances using a GitLab-hosted gateway do not need to act, and a CISA assessment added to the CVE record on 2 October lists exploitation as 'none'.
Why It Matters
AI gateways are a new class of infrastructure that many asset inventories and patch cycles do not yet cover, and they sit close to source code and developer credentials. With no workaround available, organisations that chose self-hosting for data control now have to patch quickly. The absence of known exploitation leaves a window that should be used before that status changes.
Sources
- The Hacker News (opens in a new tab): GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers (2026-10-03)
More From This Briefing
- California Attorney General subpoenas OpenAI over models that breached Hugging Face systems
- FTC prepares information demands to OpenAI, Anthropic and other AI developers over product safety
- CISA adds exploited Citrix NetScaler flaw and chained Zammad flaws to KEV catalogue
- Talcott closes $6.3bn reinsurance deal on Lincoln Financial legacy universal life block
This story is part of the Laurenceo Intelligence briefing for 5 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.