Affected Systems
GitLab AI Gateway versions 18.1.6 through 19.4.0 on self-hosted deployments. Authenticated users with Duo Agent Platform access can exploit. GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways are NOT affected.
Exploitation Status
No active exploitation reported. CISA assessment lists exploitation as "none" as of October 2, 2026. No public proof-of-concept available. Vulnerability disclosed via HackerOne by researcher invisiblemeerkat.
Business Impact
Authenticated attackers with Duo Agent Platform access can execute arbitrary commands on self-hosted AI Gateway instances via crafted custom flow configurations. Compromised gateways expose JWT signing keys (treated as sensitive credentials), connections to GitLab instances, and AI model provider access. Only affects organizations self-hosting their own AI Gateway; GitLab-managed gateways already patched. No detection method or workaround provided for unpatched systems.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update self-hosted GitLab AI Gateway to version 19.2.4, 19.3.2, or 19.4.1 depending on your GitLab release line
- For Docker deployments: stop and remove running container, pull new image tag (e.g., self-hosted-v19.4.1-ee), and redeploy
- For Helm deployments: update the image tag in the chart's image setting to the patched version
- Audit Duo Agent Platform access permissions and review custom flow configurations for anomalies
- Rotate JWT signing keys on updated gateways as a precautionary measure given their exposure in compromised scenarios