GitLab patches critical RCE flaw in self-hosted AI Gateway

GitLab urged customers on 2 October 2026 to immediately patch a critical vulnerability in its AI Gateway, the service that connects a GitLab instance to AI models. According to an advisory from the company, the flaw could let a logged-in user with access to the Duo Agent Platform run arbitrary commands on the gateway under certain conditions. The issue carries a CVSS score of 9.9, near the top of the severity scale.

Only organisations that run their own AI Gateway need to act, The Hacker News reported. Customers on GitLab's hosted service are not required to take action. Fixes are available in gateway versions 19.2.4, 19.3.2 and 19.4.1.

BleepingComputer reported that GitLab warned customers to patch immediately because the vulnerability could allow attackers to run arbitrary commands on vulnerable instances. Neither source reports evidence of exploitation in the wild.

The AI Gateway sits between a self-hosted GitLab instance and the large language models behind GitLab Duo, the company's AI assistant and agent product. The Duo Agent Platform is the layer that runs AI agents against a customer's code and project data. Because the gateway brokers those model calls, it typically holds credentials and network access on behalf of the whole instance. That is what makes command execution on the gateway serious: the attacker is not just inside a sandboxed chat session, but on the host that mediates AI traffic for the organisation.

The precondition matters for assessing exposure. The advisory, as summarised by The Hacker News, describes an authenticated user with Duo Agent Platform access, not an anonymous attacker on the internet. For a large self-hosted deployment with many developers, contractors and service accounts, that is still a wide pool. It also includes anyone who has obtained a valid session or token by other means.

The pattern will be familiar to teams tracking agent infrastructure. Gateways, model proxies and agent runtimes are new pieces of middleware that often inherit broad permissions because they need to talk to code repositories, issue trackers and model providers at once. A command execution bug in that position converts an ordinary user account into a foothold on shared infrastructure.

Neither source names a researcher or reporter for the flaw, and neither gives technical detail on how the command execution is triggered. GitLab has not published indicators of compromise in the material reported by either outlet.

Self-hosting customers should check which gateway version they are running and upgrade to 19.2.4, 19.3.2 or 19.4.1 depending on their release branch. Where an immediate upgrade is not possible, reviewing which accounts currently hold Duo Agent Platform access is the obvious interim step, since that access is the stated precondition for the attack. The issue is listed as resolved by the vendor.