Loading story…
GitLab remediated CVE-2026-1868, a critical flaw in the Duo Workflow Service component of GitLab AI Gateway caused by improper neutralization during template expansion of user-supplied data. By submitting crafted Duo Agent Platform Flow definitions, an attacker could trigger denial of service or potentially achieve remote code execution (RCE) on the AI Gateway, turning the AI workflow feature into an execution path on the underlying gateway service.
The issue impacts self-hosted GitLab AI Gateway deployments across multiple version tracks, including versions starting at 18.1.6, 18.2.6, and 18.3.1 up to vulnerable releases such as 18.6.1, 18.7.0, and 18.8.0. GitLab released fixes in 18.6.2, 18.7.1, and 18.8.1; exploitation requires authenticated access to the GitLab instance (e.g., a compromised developer account or malicious insider), and GitLab reported the issue was discovered internally (by a GitLab team member, per reporting).
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-103 highlighting GitLab's February 6 security advisory and urging administrators to review the issue and apply the required updates. The alert reiterated the affected version ranges and the patched releases.
On February 6, 2026, GitLab published a security advisory for CVE-2026-1868 affecting self-hosted GitLab Duo AI Gateway deployments. GitLab released fixes in versions 18.6.2, 18.7.1, and 18.8.1 and advised self-managed customers to upgrade immediately.
GitLab reported that CVE-2026-1868, an insecure template expansion issue in the Duo Workflow Service of GitLab AI Gateway, was discovered internally by a team member identified as Joern. The flaw could allow denial of service or arbitrary code execution through crafted Duo Agent Platform Flow definitions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released AI Gateway versions **19.2.4, 19.3.2, and 19.4.1** to fix **CVE-2026-90970**, a critical improper neutralization vulnerability rated **9.9 on CVSS v3.1**. Under certain conditions, an authenticated user with Duo Agent Platform access could submit a specially crafted flow configuration, escape the prompt template sandbox, and execute arbitrary commands on the AI Gateway. GitLab conducted targeted customer outreach before announcing the patches; the supplied notices do not report exploitation. GitLab strongly recommends that affected **Self-Hosted AI Gateway** installations upgrade immediately to the applicable patched version. GitLab-hosted AI Gateways have already been patched, so GitLab.com, GitLab Dedicated, and GitLab Self-Managed customers using those hosted gateways need no action. The Canadian Centre for Cyber Security reinforced the update guidance in advisory **AV26-994**, identifying affected releases preceding the three fixed versions and urging administrators to review GitLab’s guidance and apply necessary updates.
Oct 2, 2026
GitLab released CE and EE versions **19.3.1**, **19.2.5**, and **19.1.7** to remediate seven security vulnerabilities, led by **CVE-2026-18252** (CVSS 8.7). The flaw lets an authenticated GitLab EE user with Developer privileges execute arbitrary commands in CI contexts by abusing user-controlled configuration processed by the GitLab Duo Claude AI agent. Affected EE releases span 18.9 through 19.1.6, 19.2 through 19.2.4, and 19.3 prior to 19.3.1; no workaround is available. The patches also resolve authenticated denial-of-service issues involving background-job processing and SCIM provisioning, plus authorization and access-control weaknesses. GitLab.com and GitLab Dedicated are already patched, while self-managed customers should upgrade immediately; single-node deployments should plan for downtime while database migrations complete, whereas correctly configured multi-node deployments can use zero-downtime upgrade procedures. No exploitation of CVE-2026-18252 has been publicly confirmed.
Aug 28, 2026
GitLab patched **CVE-2026-85706**, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material. Organizations should urgently upgrade to GitLab versions **19.1.8**, **19.2.6**, or **19.3.2**, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including **CVE-2026-87719**, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
Sep 19, 2026