PT-2026-6978 · Gitlab · Gitlab Ai Gateway

Joern Schneeweisz · Published 2026-02-06 · Updated 2026-05-21 · CVE-2026-1868

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 18.8.0

Description The GitLab AI Gateway’s Duo Workflow Service component contains a flaw related to improper code generation. This issue allows authenticated attackers to cause a Denial of Service or achieve Remote Code Execution (RCE) by submitting specially crafted requests. The vulnerability stems from insecure template expansion of user-supplied data within crafted Duo Agent Platform Flow definitions.

Recommendations Upgrade to GitLab AI Gateway version 18.6.2 or later. Upgrade to GitLab AI Gateway version 18.7.1 or later. Upgrade to GitLab AI Gateway version 18.8.1 or later.

Fix

DoS

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

BDU:2026-01466

CVE-2026-1868

Affected Products

Gitlab Ai Gateway

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2026-1868 · Security Note
• https://bdu.fstec.ru/vul/2026-01466 · Security Note
• https://twitter.com/PurpleOps_io/status/2020437639636148386 · Twitter Post
• https://twitter.com/threatcluster/status/2020784825423089709 · Twitter Post
• https://twitter.com/CisoRaging77913/status/2023267143505089000 · Twitter Post
• https://t.me/pentestingnews/72955 · Telegram Post
• https://twitter.com/TheHackerWire/status/2020758867333022021 · Twitter Post
• https://twitter.com/HugoValters/status/2057405377205940440 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2021094665684988137 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2020407803995685279 · Twitter Post
• https://twitter.com/Komodosec/status/2033243238241579126 · Twitter Post
• https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850 · Note
• https://t.me/CVEtracker/44178 · Telegram Post
• https://t.me/cveNotify/151371 · Telegram Post
• https://twitter.com/CveFindCom/status/2020923404413444115 · Twitter Post