CVE-2026-90970 by the Numbers: A 9.9 Score, Three Fixed Releases and 1,338,769 Indexed GitLab Assets

Vulnerability overview

CVE-2026-90970 is a critical GitLab AI Gateway vulnerability rated CVSS 9.9 under CVSS 3.1 and classified CWE-1336. The quantitative picture around the flaw, from severity scoring to exposed GitLab footprint, frames what defenders should prioritize.

Where the numbers come from

GitLab's CVSS vector includes a scope change, which is why a gateway flaw carries a severity that would otherwise seem reserved for internet-facing services. Scope change signals that a compromise of the vulnerable component affects resources beyond it, and the gateway's access to prompts, completions and provider credentials supports that assessment.
Cyberspace search data adds an exposure dimension. A ZoomEye query for the GitLab application fingerprint, app="GitLab", returned 1,338,769 indexed assets, a figure that describes matching product deployments rather than confirmed vulnerable instances. A companion query for the CVE itself, vul.cve="CVE-2026-90970", returned a count of 0, which is expected for a freshly disclosed flaw and confirms that search engines had not yet indexed CVE-tagged hosts. Neither number should be read as a victim count.

Mechanism and exploitation conditions

GitLab reports that an authenticated user can escape the prompt template sandbox via a specially crafted flow configuration, producing arbitrary command execution on the AI Gateway. Two conditions gate exploitation: a valid Duo Agent Platform identity and a self-hosted gateway. GitLab fixed its hosted gateways before publication.

Impact

Command execution inside the gateway exposes prompts, completions and model provider credentials, and it permits modification of responses returned to developers. The three GitLab AI Gateway releases that carry fixes are 19.2.4, 19.3.2 and 19.4.1. No exploitation has been confirmed, no public proof-of-concept exists, and the flaw is not listed in CISA's KEV catalog.

Affected products and scope

Affected builds are 18.1.6 up to but not including 19.2.4, along with 19.3 before 19.3.2 and 19.4 before 19.4.1. Only self-hosted gateways are in scope; GitLab.com, GitLab Dedicated and Self-Managed deployments using a GitLab-hosted AI Gateway are already protected.

Remediation and mitigations

Upgrade to 19.2.4, 19.3.2 or 19.4.1, then rotate model provider credentials and review stored flows for unexplained template logic. Use the exposure figure as context for prioritization rather than as a measure of vulnerability, and treat the fix status of the gateway, not the popularity of the product, as the decision input.
An accurate reading of these numbers is itself a control. Correlating a 9.9 severity with 1,338,769 indexed GitLab assets can tempt teams to overstate the population at risk; a 0 for the CVE query can tempt them to understate it. Neither substitutes for checking the gateway build.