GitLab Patches Critical AI Gateway Flaw Enabling Command Execution on Self-Hosted Deployments

GitLab has disclosed and patched a critical vulnerability (CVSS 9.9) in its AI Gateway, the service that connects GitLab instances to AI models powering features like the Duo Agent Platform. According to GitLab's advisory, a logged-in user with Duo Agent Platform access could, under certain conditions, execute commands on the gateway.

What Was Reported

GitLab says the flaw affects organizations that self-host their own AI Gateway rather than relying on GitLab's managed instance. The issue has been fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. Technical root-cause details beyond "command execution under certain conditions" were not included in the available reporting.

Why It Matters for Defenders

A 9.9 severity command-execution flaw in an AI Gateway is a significant exposure: this component sits at the trust boundary between an internal GitLab deployment and external or self-hosted AI models, often with access to source code, CI/CD pipelines, and internal network segments. Only organizations running self-hosted AI Gateway instances are affected — GitLab-managed deployments are not described as impacted. Because exploitation requires an authenticated user with Duo Agent Platform access rather than an unauthenticated attacker, the primary risk is privilege escalation or lateral movement by an insider, a compromised account, or an attacker who has already gained a foothold.

What Defenders Should Do Now

• Identify whether your organization runs a self-hosted AI Gateway and confirm its version; upgrade to 19.2.4, 19.3.2, or 19.4.1 as appropriate.
• Review which accounts hold Duo Agent Platform access and tighten that list to least-privilege.
• Audit AI Gateway logs for anomalous command or process activity, unexpected outbound connections, or activity from accounts that shouldn't normally interact with the gateway.
• Treat the AI Gateway host as a sensitive asset in network segmentation and monitoring — it likely has access to source repositories and CI/CD credentials.
• Watch for follow-up advisories or proof-of-concept details from GitLab or the research community that could clarify the exploitation path.

This is developing, net-new intelligence based on a single source, and further technical details were not fully available at publication. For the original report, see The Hacker News.