{"vulnerability": "cve-2026-9097", "sightings": [{"uuid": "def60c98-06e9-4f7a-9603-b6b236bcc35b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90979", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4vvqrwdkq2eji", "content": "CVE-2026-90979 - Apache Karaf: LDAP filter injection in JAAS LDAP login modules\nCVE ID : CVE-2026-90979\n \n Published : 28. September 2026 10:16 | 13\u00a0Minuten ago\n \n Description : LDAPCache\u00a0and\u00a0LDAPBackingEngine\u00a0build LDAP search filters for user lookup and role lookup by textua...", "creation_timestamp": "2026-09-28T10:53:20.365667Z"}, {"uuid": "880120e5-25b7-4738-aabc-8f2437609a8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwvmgzqpma2c", "content": "CVE-2026-90970: GitLab has patched a critical flaw in its AI Gateway. An authenticated user with Duo Agent Platform access could escape the prompt template sandbox and run arbitrary commands. Fixed in AI Gateway 19.2.4, 19.3.2, and 19.4.1.", "creation_timestamp": "2026-10-02T14:46:47.245782Z"}, {"uuid": "87a053bb-80cd-4123-8493-402cda1fb7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwvoar6cjv24", "content": "\ud83d\udd34 CVE-2026-90970 - Critical (9.9)\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions o...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90970/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-02T15:19:05.064151Z"}, {"uuid": "0bccaa2e-984a-416f-ae98-c7a2a5f07eb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5aebud5uxkkku", "content": "CVE-2026-90970 - Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway\nCVE ID : CVE-2026-90970\n \n Published : Oct. 2, 2026, 2:34 p.m. | 46\u00a0minutes ago\n \n Description : GitLab has remediated a vulnerability in the GitLab AI Gateway component...", "creation_timestamp": "2026-10-02T16:00:12.141143Z"}, {"uuid": "7901041f-2c18-4b84-af96-4062c5da8666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwvqxyfd6c2z", "content": "\ud83d\udea8 CVE-2026-90970 \u2014 CVSS 9.9 CRITICAL\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI G...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90970\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-02T16:07:50.982044Z"}, {"uuid": "e3b6d5dd-2912-4151-be49-ea134635f1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117372237470161835", "content": "Go hack more AI shit.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-90970\nsev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.", "creation_timestamp": "2026-10-02T16:23:35.256896Z"}, {"uuid": "d1d05584-08cb-40da-8938-275d6fbfc338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwvuzdajuh2j", "content": "\ud83e\udd16 CVE-2026-90970 (critical): RCE in GitLab AI Gateway. Duo Platform users can escape the prompt sandbox and run commands on self-hosted instances. Patch: 19.2.4/19.3.2/19.4.1.\nhttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/", "creation_timestamp": "2026-10-02T17:20:10.754290Z"}, {"uuid": "1b2533ab-d423-46af-a52d-0ca6dc1ea458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwvvqlbcnu2m", "content": "GitLab fix for AI Gateway CVE-2026-90970 lets self-hosted users avoid command-execution risks. #GitLab #AI #Security #CVE2026 #Cybersecurity #AIsecurity https://thedailytechfeed.com/critical-gitlab-ai-gateway-bug-lets-duo-agent-users-execute-commands/", "creation_timestamp": "2026-10-02T17:33:11.730231Z"}, {"uuid": "6c83e73c-3ccf-4ecf-acfc-c027d8bd3be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwvwdf2j5d2m", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:43:42.490538Z"}, {"uuid": "2fd3d1de-b71b-4224-ac15-f9f89bc1eb71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwvwfjslhk2y", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:44:54.909280Z"}, {"uuid": "fe2d16a4-a3f6-418a-b691-899165816377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mwvwgfy34q2f", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:45:24.212027Z"}, {"uuid": "79a3150c-abc9-4c43-ae36-fbda069b8bdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mwvxausepk2i", "content": "Insider 26340.9596 adds Cloud Rebuild; 28120.3151 adds remote reset/Magnifier controls. Patch GitLab Duo CVE-2026-90970 RCE. Move apps off C:. Teams side chats: Nov. DGX Spark 64GB: $4,999. +25 more stories", "creation_timestamp": "2026-10-02T18:00:13.020695Z"}, {"uuid": "9f484b86-b272-4d18-8889-1da333638823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwwaida5or2r", "content": "GitLab disclosed CVE-2026-90970, a critical AI Gateway RCE that can let authenticated users with basic privileges escape the sandbox and run arbitrary commands on self-hosted instances. #GitLab #CVE202690970 #AIGateway", "creation_timestamp": "2026-10-02T20:45:26.096650Z"}, {"uuid": "a894d19c-f677-4501-b9e6-198bb024ead2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwwdozrmrw2y", "content": "GitLab AI Gateway vulnerability CVE-2026-90970 (CVSS 9.9) lets Duo Agent Platform users run commands. Upgrade self-hosted gateways now.\n\n#GitLab #AIGateway #GitLabDuo #CVE202690970 #RCE #DevSecOps #Vulnerability", "creation_timestamp": "2026-10-02T21:42:51.392925Z"}, {"uuid": "a3ada77f-0992-4ff6-9c85-5e7bc872aba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwweol2mij2r", "content": "GitLab fixed CVE-2026-90970, a critical 9.9 AI Gateway flaw in self-hosted servers that could let logged-in Duo Agent Platform users run commands. Patched in 19.2.4, 19.3.2, and 19.4.1. #GitLab #CVE202690970 #DuoAgentPlatform", "creation_timestamp": "2026-10-02T22:00:30.770172Z"}, {"uuid": "df7f371f-759c-4b13-8637-fb75c002f143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwwyvbnbmw22", "content": "BREAKING: GitLab warns of critical RCE vulnerability in AI Gateway service. CVE-2026-90970 (CVSS high) allows arbitrary command execution on vulnerable self-hosted instances. Versions 19.2.4 / 19.3.2 / 19.4.1 released \u2014 upgrade immediately. Source: BleepingComputer, Oct 2. #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-03T04:02:09.566081Z"}, {"uuid": "c52f4a4c-5b4a-4c21-9b2a-db4d8284e52c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwwx5vv67c2c", "content": "\ud83e\udd16 GitLab patches CVE-2026-90970 (CVSS 9.9): logged-in Duo Agent Platform users can run commands on the AI Gateway. Self-hosted gateways only. Fixed in 19.2.4/19.3.2/19.4.1.\nhttps://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html", "creation_timestamp": "2026-10-03T03:31:12.300028Z"}, {"uuid": "2688b7ce-2a06-4bd3-b886-f4ef0f6c7b5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwx4btyyh223", "content": "Daily IT Security Digest \u2014 2026-10-03\nhttps://infosec.exchange/@offseq/117319888106479032\n\n## 3. GitLab AI Gateway Critical RCE (CVE-2026-90970)\nGitLab issued an urgent advisory for a critical remote code execution vulnerability in its AI Gateway service (CVE-2026-90970, CVSS High). The flaw allows", "creation_timestamp": "2026-10-03T05:02:52.711528Z"}, {"uuid": "2539ba12-f9b4-4214-8167-1915df3473c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwxc5sui2s2r", "content": "\ud83d\udcf0 GitLab Peringatkan Kerentanan RCE Kritis CVE-2026-90970 pada AI Gateway\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/03/gitlab-ai-gateway-cve-2026-90970-rce/\n\n#ai #artificialIntelligence #cisa #cybersecurity #gitlab #keamananSiber #vulnerability", "creation_timestamp": "2026-10-03T06:48:00.749462Z"}]}