CriticalCVE
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
The Hacker News·Source published ·1 min read
What happened?
A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. The flaw
Key details
- GitLab's AI Gateway contains a critical flaw that may allow a logged‑in Duo Agent Platform user to execute commands on the gateway under specific conditions.
- The vulnerability has been patched in AI Gateway releases 19.2.4, 19.3.2, and 19.4.1.
- The flaw resides in the prompt‑template of a custom flow, allowing an attacker to escape the sandbox and run arbitrary commands.
- A self‑hosted gateway stores JWT signing keys, which GitLab advises treating as highly sensitive credentials.
Affected
- All AI Gateway versions from 18.1.6 up through the 19.1 line are vulnerable because no fix exists before 19.2.4.
- Only organizations that host their own gateway are required to apply the remediation.
Fixes and mitigations
- To remediate Docker deployments, stop and remove the container then pull and run the updated image tag, e.g., self‑hosted‑v19.4.1‑ee.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.