CVE-2026-90970Vulnerability

1. “In early October, GitLab released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to execute arbitrary commands on the gateway.”

   Security AffairsNews13 Oct 2026
   GitLab Patches Max-Severity Vulnerability CVE-2026-97229

2. “The disclosure comes weeks after it remediated a critical flaw in AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration and a…”

   The Hacker NewsNews13 Oct 2026
   GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

3. “CVE-2026-90970”

   CERT-FRGovernment12 Oct 2026
   Bulletin d'actualité CERTFR-2026-ACT-043 (12 octobre 2026)

4. “…E-2026-73856 (ModSecurity), CVE-2026-12855 (InsydeH2O IHISI SMM), MTLVULN-1694 (Mitel MiCollab), CVE-2026-81963 (Microsoft Windows), CVE-2026-90970, CVE-2026-1868 (GitLab AI Gateway), CVE-2026-79898, CVE-2026-12627, CVE-2026-79901 (Fortra BoKS), CVE-2026-93698, CVE-2026-93029, CV…”

   The Hacker NewsNews5 Oct 2026
   ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

5. “GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.”

   Check Point ResearchVendor5 Oct 2026
   5th October – Threat Intelligence Report

6. “CVE-2026-90970: GitLab AI Gateway RCE”

   SOCRadarVendor5 Oct 2026
   CVE-2026-90970: GitLab AI Gateway RCE

7. “Référence CVE CVE-2026-90970”

   CERT-FRGovernment5 Oct 2026
   Vulnérabilité dans GitLab (05 octobre 2026)

8. “CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed”

   Security AffairsNews4 Oct 2026
   Security Affairs newsletter Round 598 by Pierluigi Paganini – INTERNATIONAL EDITION

9. “CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed”

   Security AffairsNews3 Oct 2026
   CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

10. “The flaw is tracked as CVE-2026-90970.”

    The Hacker NewsNews2 Oct 2026
    GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

• hxxps://docs.gitlab[.]com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/in 2 reports

Also named with it: CVE-2026-86950, CVE-2026-76504, CVE-2026-1868, CVE-2026-14814, CVE-2026-16301, CVE-2026-92883, CVE-2026-97229, CVE-2026-48842, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248