Who is affected by GitLab AI Gateway CVE-2026-90970? Upgrade checks

Which gateways need the patch

GitLab's October 2, 2026 announcement fixes CVE-2026-90970, CVSS 9.9. Under certain conditions, an authenticated user with Duo Agent Platform access could bypass the template sandbox and execute arbitrary commands on the gateway.

Affected AI Gateway ranges are ≥18.1.6 and <19.2.4, ≥19.3 and <19.3.2, and ≥19.4 and <19.4.1. Fixed versions are 19.2.4, 19.3.2 and 19.4.1 respectively. GitLab-hosted gateways are patched, including GitLab.com, Dedicated and Self-Managed using hosted gateways; those users need no self-managed action for this patch.

Step 1: Inspect gateway deployment, not just the GitLab web version

GitLab Duo supports hosted, self-hosted and hybrid configurations. The Self-Managed label alone does not identify who maintains the gateway. Use the official Configure GitLab Duo documentation to determine the deployment actually serving the feature.

Ask the configuration owner for three things: the main GitLab version, the gateway deployment and running image, and its maintainer. Do not copy the web-footer version into the gateway-version field. For internal domains, identify the actual service behind them; identical entry names do not mean testing and production share an instance.

List target instances and maintenance windows first. Include every replica in later checks, avoiding declaring completion after updating just one. This is a procedure based on public documentation, not a test of the reader's environment.

Step 2: Choose a compatible patch and preserve deployment parameters

Official installation guidance requires the latest stable AI Gateway tag matching GitLab's major and minor version, in self-hosted-vX.Y.*-ee format. Do not use nightly.

Check compatibility together with the fixed ranges. If an old branch lacks a supported image satisfying the fix, do not blindly jump to the highest release in another branch. Confirm a coordinated GitLab and gateway upgrade path with maintainers or official support.

Before updating, preserve deployment declarations, configuration-file locations and credential-reference methods, and confirm someone can restore them. Check ports, networks, mounts and certificates survive recreation. Tickets should contain references and redacted values, not keys. Confirm the target image can be retrieved before entering downtime.

Step 3: Replace the image through the existing deployment method

For Docker, follow the official Updating procedure: stop and remove the old container, then recreate with the new image and all environment variables. For Helm, inspect chart version and image.tag separately, retaining the original release, namespace and required settings. A successful chart upgrade does not prove the image changed.

Use the official installation page and the environment's original deployment files for actual execution. Have the maintainer verify container names, service names and configuration sources in proposed commands first. Do not overwrite production with a fresh-install example.

Kubernetes tags can point to different images, while a digest pins content. IfNotPresent may reuse a local image. Follow the existing release strategy and inspect actual running results afterward; unchanged tag text alone is insufficient.

Step 4: Verify the service actually runs the target image

Docker inspect can output selected fields. On the container host, use the read-only example: docker inspect --type=container --format '{{.Config.Image}} {{.Image}}' gitlab-aigw. Replace gitlab-aigw with the real container name first. The results are the configured image reference and the local image ID used by the container.

Then query the downloaded target with docker image inspect --format '{{.Id}} {{json .RepoDigests}}' IMAGE_REFERENCE. Replace IMAGE_REFERENCE with the complete image reference. Compare Image from the first command with Id from the second. RepoDigests is a different identifier type and should not be compared directly with a local image ID.

If release records show the new tag but the running container's ID differs from the target, check whether recreation occurred and whether you inspected the correct container or host. A new image in the image list proves only that the host has it. Verify every instance, retaining version and comparison results without exporting complete environment variables.

Step 5: Separate version checks from functional checks

GitLab provides health checks at Admin > GitLab Duo. After verifying versions, check gateway connectivity and have an authorized user perform one previously working ordinary Duo operation in a test project.

Choose a nonsensitive task with an easily verified result and observe completion. Health checks and successful business requests validate availability; the image comparison establishes whether the fixed version runs. There is no need to exploit the vulnerability to prove the patch.

Diagnose by failure stage: image retrieval failures need reference and registry-access checks; startup failures need old/new configuration comparison; authentication or connection failures after startup need relevant settings and logs. Do not change image, keys and network simultaneously and make the next failure harder to isolate.

If upgrading fails, restore configuration rather than the vulnerability

Agree on a failure owner and pause scope beforehand. If normal operation cannot be restored promptly, pause affected access through existing management procedures and investigate on a supported fixed version. Do not keep re-enabling a confirmed vulnerable image for short-term availability, or disable authentication to pass acceptance.

Support requests should include deployment method, GitLab and gateway versions, target image reference, failing stage, redacted error and time. If restoring an older setting is necessary, confirm compatibility with the fixed version, restore it individually and retest. This narrows differences without a wholesale rollback that reintroduces the vulnerability.