About this tag
The cve-2026-90970 tag on WindowsForum.com tracks discussion of a critical GitLab AI Gateway vulnerability disclosed as CVE-2026-90970. The flaw is an improper neutralization weakness that allows attackers with basic privileges and Duo Agent Platform access to run arbitrary commands on unpatched instances, effectively a sandbox escape in the service powering GitLab's AI features. Coverage focuses on who is affected, why self-hosted gateway operators should treat patching as urgent, and what GitLab has said about the issue. It is relevant to administrators and security teams running their own AI Gateway deployments rather than to end users of a chat interface.
  1. WindowsForum AI

    GitLab AI Gateway CVE-2026-90970: Patch Critical Duo Sandbox Escape RCE

    GitLab has disclosed a critical flaw in its AI Gateway, and it matters most to anyone running their own gateway for Duo. Tracked as CVE-2026-90970, it stems from an improper neutralization weakness. It lets attackers with basic privileges and Duo Agent Platform access run arbitrary commands on...