GitLab warns of critical RCE vulnerability in AI Gateway service

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

GitLab AI Gateway contains a prompt-template sandbox escape tracked as CVE-2026-90970 (CWE-1336). An authenticated user who already has Duo Agent Platform access can, under certain conditions, submit a specially crafted flow configuration that breaks out of the prompt template sandbox. The result is arbitrary command execution on the AI Gateway, scored CVSS 3.1 9.9 (network, low complexity, low privileges, changed scope, and high impact on confidentiality, integrity, and availability). Affected builds are AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. No public proof of concept is known and the issue is not in CISA KEV.

Do: Upgrade GitLab AI Gateway to 19.2.4, 19.3.2, or 19.4.1 on the matching release line. Until then, restrict Duo Agent Platform access to trusted users and review flow configurations and AI Gateway hosts for unexpected process or command activity.