---
title: "A self-hosted AI gateway is a privileged execution boundary, not just a model proxy"
description: "GitLab patched CVE-2026-90970 after a crafted Duo flow could escape the AI Gateway template sandbox and execute commands. Self-hosted gateways need isolation, patch ownership and credential containment."
url: "https://devencelab.com/insights/2026/10/02/a-self-hosted-ai-gateway-is-a-privileged-execution"
date: "2026-10-02"
section: "Insights"
tag: "AI Security"
author: "Devence Lab"
reading_time: "2 min read"
site: "Devence Lab"
license: "Readable and quotable with attribution to the canonical URL."
---

# A self-hosted AI gateway is a privileged execution boundary, not just a model proxy

GitLab patched CVE-2026-90970 after a crafted Duo flow could escape the AI Gateway template sandbox and execute commands. Self-hosted gateways need isolation, patch ownership and credential containment.

GitLab patched CVE-2026-90970 on 2 October after finding that an authenticated user with Duo Agent Platform access could escape the AI Gateway prompt-template sandbox through a crafted flow configuration and reach arbitrary command execution. GitLab rates the flaw 9.9. Self-hosted gateway operators should move to 19.2.4, 19.3.2 or 19.4.1 immediately.

The affected component is not merely a proxy that forwards prompts. GitLab’s AI Gateway sits between agentic flows, the GitLab instance and model providers. In self-hosted deployments it also handles sensitive credentials used by that control path. A sandbox escape therefore crosses from model workflow configuration into infrastructure execution.

## Patch the gateway as privileged infrastructure

GitLab says its hosted gateways are already remediated; the urgent action applies to customers operating GitLab Duo Self-Hosted AI Gateway installations. Those teams should inventory the gateway version independently of the main GitLab version, because the gateway ships as its own container image or Helm deployment.

That separation needs an explicit owner. Put the gateway into the same vulnerability-management tier as CI runners, secrets infrastructure and other services that can execute work on behalf of developers. Track its image digest and deployed version, define an emergency patch path and alert when an unsupported image remains running.

> An AI gateway that can execute agent workflows belongs in the privileged compute inventory, not the integration catalogue.

## Assume sandbox escape reaches credentials

The security boundary should limit what survives a template-engine failure. Run the gateway with a minimal service identity, remove unnecessary host mounts, restrict outbound destinations and keep model-provider and GitLab credentials scoped to the smallest required permissions. Network policy should prevent a compromised gateway from becoming a general route into internal services.

Credential rotation also belongs in the incident plan. If exploitation is suspected, rebuilding the container is not enough when the process could have read signing material or service tokens. Preserve logs, replace exposed credentials and review actions performed through the gateway identity during the suspected window.

## Treat custom flows as executable input

The exploit path matters beyond this CVE. A user who is legitimately allowed to define an agentic flow can still supply configuration that reaches a vulnerable interpreter. Flow configuration therefore deserves validation and provenance controls similar to pipeline definitions or infrastructure-as-code, rather than being treated as harmless prompt metadata.

For self-hosted agent platforms, the operational test is simple: if a workflow definition escapes its intended interpreter, the surrounding runtime should still expose little worth taking. Patch CVE-2026-90970 now, then use the incident to verify that the gateway is isolated, least-privileged and recoverable as a privileged execution service.

## Sources

- [GitLab AI Gateway 19.4.1 released](https://about.gitlab.com/releases/2026/10/02/patch-release-gitlab-ai-gateway-19-4-1-released/) - GitLab
- [GitLab warns of critical RCE vulnerability in AI Gateway service](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/) - BleepingComputer