CVSS 9.9. A logged-in user escapes the prompt-template sandbox in GitLab's self-hosted AI Gateway and runs system commands on the box that brokers every agent's access. The component built to contain the model became the way in.
CVE-2026-90970 is the one to read this week. An authenticated user with access to the Duo Agent Platform can break out of a custom flow's prompt-template sandbox and execute commands on the gateway. The guidance is standard: patch, restrict who can touch the Duo Agent Platform, and inspect custom flow configurations for changes nobody remembers making. The same stretch of October also saw GitLab fix an unauthenticated RCE tracked as CVE-2026-97229. Busy month.
This is a pattern
Pull back and the whole gateway class looks rough. MCPJam's inspector, up to version 1.4.2, listened on 0.0.0.0 by default with no authentication on its critical endpoint; one crafted HTTP request installs an MCP server and executes code on the host, CVSS 9.8. MaxKB went from prompt injection straight through to a sandbox bypass, CVE-2026-77521. Ox Security's earlier work on the MCP STDIO launch model counted over 200 open source projects, 150 million downloads, 7,000+ publicly reachable servers and up to 200,000 vulnerable instances, with Anthropic's position being that the behaviour is by design and sanitisation is the developer's responsibility. I have spent enough of this year inside that ecosystem to file two MCP CVEs of my own, CVE-2026-30615 and CVE-2026-26030, and nothing I found suggests the floor is rising quickly.
Concentration is the point, and the problem
A gateway concentrates trust on purpose. Every agent's traffic through one hop. Tokens for every downstream tool in one credential store. Both directions visible at once, which is exactly why it is the right control point, and exactly why it is the most attractive box on the network. When a gateway falls it falls holding everyone's keys. Meanwhile the phrase it's sandboxed is doing heavy load-bearing work in vendor decks, and a template sandbox with a path to a shell was never a sandbox. It was a speed bump with a logo.
I run one anyway
Full disclosure, I am not writing this from the outside. Willow brokers every tool call my agents make, and I have hung my own prompt-injection regex layer off it. The gateway stays, because it remains the only point where instructions flowing in and data flowing out are visible at the same time. What changed is the classification. The gateway is tier zero now, so I treat it the way we used to treat the domain controller:
- Patch on a days clock. A 9.9 does not queue behind sprint planning.
- Keep its credentials scoped and short-lived. Mine sit behind just-in-time grants through Opal, so a popped gateway holds whatever is live in the window rather than everything ever granted.
- Log tool calls through it. Those logs are the evidence when something goes wrong, and GitLab's advice to inspect flow configs assumes you can actually tell what changed.
- Restrict who can author flows and templates against it. The GitLab escape starts from an authenticated user with platform access, which in most organisations translates to half of engineering.
Honest cost: the gateway becomes another system AppSec owns and answers for at 2am. Centralising was still right. Decentralised agent access carries the same blast radius with none of the logs.
Verdict
Buy the gateway. Then threat model it as the thing it actually became, the most privileged identity broker you own. GitLab's 9.9 will not be the last of these. It is only the first one that arrived with a CVSS score attached to the lesson.
Sources: eSecurity Planet on CVE-2026-90970 · Weekly intel briefing, week of 12 October · The Vulnerable MCP Project · Infosecurity Magazine on the Ox Security MCP finding
No comments:
Post a Comment