{"vulnerability": "cve-2026-90970", "sightings": [{"uuid": "880120e5-25b7-4738-aabc-8f2437609a8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwvmgzqpma2c", "content": "CVE-2026-90970: GitLab has patched a critical flaw in its AI Gateway. An authenticated user with Duo Agent Platform access could escape the prompt template sandbox and run arbitrary commands. Fixed in AI Gateway 19.2.4, 19.3.2, and 19.4.1.", "creation_timestamp": "2026-10-02T14:46:47.245782Z"}, {"uuid": "87a053bb-80cd-4123-8493-402cda1fb7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwvoar6cjv24", "content": "\ud83d\udd34 CVE-2026-90970 - Critical (9.9)\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions o...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90970/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-02T15:19:05.064151Z"}, {"uuid": "0bccaa2e-984a-416f-ae98-c7a2a5f07eb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5aebud5uxkkku", "content": "CVE-2026-90970 - Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway\nCVE ID : CVE-2026-90970\n \n Published : Oct. 2, 2026, 2:34 p.m. | 46\u00a0minutes ago\n \n Description : GitLab has remediated a vulnerability in the GitLab AI Gateway component...", "creation_timestamp": "2026-10-02T16:00:12.141143Z"}, {"uuid": "7901041f-2c18-4b84-af96-4062c5da8666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwvqxyfd6c2z", "content": "\ud83d\udea8 CVE-2026-90970 \u2014 CVSS 9.9 CRITICAL\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI G...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90970\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-02T16:07:50.982044Z"}, {"uuid": "e3b6d5dd-2912-4151-be49-ea134635f1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117372237470161835", "content": "Go hack more AI shit.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-90970\nsev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.", "creation_timestamp": "2026-10-02T16:23:35.256896Z"}, {"uuid": "d1d05584-08cb-40da-8938-275d6fbfc338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwvuzdajuh2j", "content": "\ud83e\udd16 CVE-2026-90970 (critical): RCE in GitLab AI Gateway. Duo Platform users can escape the prompt sandbox and run commands on self-hosted instances. Patch: 19.2.4/19.3.2/19.4.1.\nhttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/", "creation_timestamp": "2026-10-02T17:20:10.754290Z"}, {"uuid": "1b2533ab-d423-46af-a52d-0ca6dc1ea458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwvvqlbcnu2m", "content": "GitLab fix for AI Gateway CVE-2026-90970 lets self-hosted users avoid command-execution risks. #GitLab #AI #Security #CVE2026 #Cybersecurity #AIsecurity https://thedailytechfeed.com/critical-gitlab-ai-gateway-bug-lets-duo-agent-users-execute-commands/", "creation_timestamp": "2026-10-02T17:33:11.730231Z"}, {"uuid": "6c83e73c-3ccf-4ecf-acfc-c027d8bd3be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwvwdf2j5d2m", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:43:42.490538Z"}, {"uuid": "2fd3d1de-b71b-4224-ac15-f9f89bc1eb71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwvwfjslhk2y", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:44:54.909280Z"}, {"uuid": "fe2d16a4-a3f6-418a-b691-899165816377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mwvwgfy34q2f", "content": "A critical GitLab AI Gateway flaw (CVE-2026-90970) could let authorized users execute commands; fixed in versions 19.2.4, 19.3.2, and 19.4.1.\n", "creation_timestamp": "2026-10-02T17:45:24.212027Z"}, {"uuid": "79a3150c-abc9-4c43-ae36-fbda069b8bdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mwvxausepk2i", "content": "Insider 26340.9596 adds Cloud Rebuild; 28120.3151 adds remote reset/Magnifier controls. Patch GitLab Duo CVE-2026-90970 RCE. Move apps off C:. Teams side chats: Nov. DGX Spark 64GB: $4,999. +25 more stories", "creation_timestamp": "2026-10-02T18:00:13.020695Z"}, {"uuid": "9f484b86-b272-4d18-8889-1da333638823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwwaida5or2r", "content": "GitLab disclosed CVE-2026-90970, a critical AI Gateway RCE that can let authenticated users with basic privileges escape the sandbox and run arbitrary commands on self-hosted instances. #GitLab #CVE202690970 #AIGateway", "creation_timestamp": "2026-10-02T20:45:26.096650Z"}, {"uuid": "a894d19c-f677-4501-b9e6-198bb024ead2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwwdozrmrw2y", "content": "GitLab AI Gateway vulnerability CVE-2026-90970 (CVSS 9.9) lets Duo Agent Platform users run commands. Upgrade self-hosted gateways now.\n\n#GitLab #AIGateway #GitLabDuo #CVE202690970 #RCE #DevSecOps #Vulnerability", "creation_timestamp": "2026-10-02T21:42:51.392925Z"}, {"uuid": "a3ada77f-0992-4ff6-9c85-5e7bc872aba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwweol2mij2r", "content": "GitLab fixed CVE-2026-90970, a critical 9.9 AI Gateway flaw in self-hosted servers that could let logged-in Duo Agent Platform users run commands. Patched in 19.2.4, 19.3.2, and 19.4.1. #GitLab #CVE202690970 #DuoAgentPlatform", "creation_timestamp": "2026-10-02T22:00:30.770172Z"}, {"uuid": "df7f371f-759c-4b13-8637-fb75c002f143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwwyvbnbmw22", "content": "BREAKING: GitLab warns of critical RCE vulnerability in AI Gateway service. CVE-2026-90970 (CVSS high) allows arbitrary command execution on vulnerable self-hosted instances. Versions 19.2.4 / 19.3.2 / 19.4.1 released \u2014 upgrade immediately. Source: BleepingComputer, Oct 2. #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-03T04:02:09.566081Z"}, {"uuid": "c52f4a4c-5b4a-4c21-9b2a-db4d8284e52c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwwx5vv67c2c", "content": "\ud83e\udd16 GitLab patches CVE-2026-90970 (CVSS 9.9): logged-in Duo Agent Platform users can run commands on the AI Gateway. Self-hosted gateways only. Fixed in 19.2.4/19.3.2/19.4.1.\nhttps://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html", "creation_timestamp": "2026-10-03T03:31:12.300028Z"}, {"uuid": "2688b7ce-2a06-4bd3-b886-f4ef0f6c7b5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwx4btyyh223", "content": "Daily IT Security Digest \u2014 2026-10-03\nhttps://infosec.exchange/@offseq/117319888106479032\n\n## 3. GitLab AI Gateway Critical RCE (CVE-2026-90970)\nGitLab issued an urgent advisory for a critical remote code execution vulnerability in its AI Gateway service (CVE-2026-90970, CVSS High). The flaw allows", "creation_timestamp": "2026-10-03T05:02:52.711528Z"}, {"uuid": "2539ba12-f9b4-4214-8167-1915df3473c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwxc5sui2s2r", "content": "\ud83d\udcf0 GitLab Peringatkan Kerentanan RCE Kritis CVE-2026-90970 pada AI Gateway\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/03/gitlab-ai-gateway-cve-2026-90970-rce/\n\n#ai #artificialIntelligence #cisa #cybersecurity #gitlab #keamananSiber #vulnerability", "creation_timestamp": "2026-10-03T06:48:00.749462Z"}, {"uuid": "266f1da9-060b-4c28-ab55-add2a9d2490c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/yasna.io/post/3mwxrwrancv2x", "content": "GitLab fixed a critical AI Gateway flaw (CVE-2026-90970) that allowed authenticated users to execute commands on self-hosted servers, urging immediate patching.\n\n#Patch #Fixed #infosec\n\nFull synthesis & sources: yasna.io", "creation_timestamp": "2026-10-03T11:30:23.649004Z"}, {"uuid": "0d820616-ad67-4278-8222-1b80925e4680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/6hut5uykeiup6", "content": "CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed", "creation_timestamp": "2026-10-03T11:34:30.465652Z"}, {"uuid": "91ef2daa-1a88-4bd3-99f7-9521b4251b9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-57f8b4c0-75273857b1352e82", "content": "GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to [\u2026]CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed", "creation_timestamp": "2026-10-03T11:44:09.979628Z"}, {"uuid": "b4ef67f2-5f35-4667-8b0c-ac41d31ead7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwxspktt2mw2", "content": "GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an [\u2026]", "creation_timestamp": "2026-10-03T11:44:22.754749Z"}, {"uuid": "b52edf31-3546-46ed-89e0-abbc8dcfc64d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwxtc4u6qs2m", "content": "CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed\n\nsecurityaffairs.com/200283/hacki...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "creation_timestamp": "2026-10-03T11:54:39.127129Z"}, {"uuid": "391df08b-a48d-461f-bd27-7e9b41cd8576", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwxtfsc3ok2f", "content": "Critical CVE-2026-90970 affects GitLab Self-Hosted AI Gateway.\n\nAn authenticated Duo Agent Platform user can potentially escape the prompt-template sandbox and execute commands on the gateway.\n\ncyberupdates365.com/cve-2026-909...\n\n#Cybersecurity #GitLab #AISecurity", "creation_timestamp": "2026-10-03T11:56:43.892838Z"}, {"uuid": "f05b26f4-cd52-4a41-bc89-31e635bbc662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/ctinow/257841", "content": "CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed\nhttps://ift.tt/y7liXK1", "creation_timestamp": "2026-10-03T11:34:13.000000Z"}, {"uuid": "ed28fb0f-774f-4610-be0f-b038d655b05c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwxypcnblg2e", "content": "Critical GitLab AI Gateway vulnerability (CVE-2026-90970) enables remote code execution on self-hosted\u00a0servers\n\nGitLab CVE-2026-90970 is a critical 9.9 AI Gateway sandbox escape affecting self-hosted deployments. Check affected\u2026\n\nhttps://thecybersecguru.com/exploits/gitlab-ai-gateway-cve-2026-90970/", "creation_timestamp": "2026-10-03T13:31:29.711214Z"}, {"uuid": "ed38a7ce-5ca2-4d5c-8859-f49c8cbb5aa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "Telegram/-O66rLh3nHxBP2EUXKRxpUSkp5i-ZPgOOv4KzANWc_aLKGBR", "content": "", "creation_timestamp": "2026-10-03T11:45:04.000000Z"}, {"uuid": "cb9cf0b7-80d7-4711-8ef4-dd2d2bee840a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwybftzog226", "content": "Self-hosted GitLab AI Gateway CVE-2026-90970, CVSS 9.9: a logged-in user with Duo Agent Platform access can escape the prompt-template sandbox and run commands. No workaround \u2014 upgrade to 19.2.4, 19.3.2 or 19.4.1. https://cti.securitycyber.uk", "creation_timestamp": "2026-10-03T16:07:15.748501Z"}, {"uuid": "c42a933e-2296-4d61-a07e-b8eed22158ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/bfliaucpsxx47", "content": "CVE-2026-90970: Critical GitLab AI Gateway Vulnerability", "creation_timestamp": "2026-10-03T16:49:42.112371Z"}, {"uuid": "c8c98203-1cf3-4e25-8c6d-5657824ceba6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mwyfcvlr2h24", "content": "A critical vulnerability in GitLab's AI Gateway, tracked as CVE-2026-90970, allows logged-in users with Duo Agent Platform access to execute commands on self-hosted servers. GitLab rated the flaw 9.9/10 and released fixes in versions 19.2.4, 19.3.2, and 19.4.1 on October 2.", "creation_timestamp": "2026-10-03T17:17:12.456422Z"}, {"uuid": "8e8c2a10-8d6b-4f77-8b91-9a0261421fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90970", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mwywqc7eni2a", "content": "GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critic...\n\n\ud83d\udd17 https://securityaffairs.com/200283/hacking/cve-2026-90970-critical-gitlab-ai-gateway-flaw-fixed.html", "creation_timestamp": "2026-10-03T22:28:54.550694Z"}, {"uuid": "de42eb64-2b6a-463e-8b7e-cc2ee31ad94b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/johnwlittle.com/post/3mwzvw3puegpj", "content": "GitLab urges self-hosted AI Gateway users to patch a critical command-execution flaw (CVE-2026-90970). Fixed versions: 19.2.4, 19.3.2, 19.4.1. GitLab-hosted gateways are already protected.\nhttps://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/", "creation_timestamp": "2026-10-04T07:47:37.168518Z"}, {"uuid": "ec0fbb81-55c0-42ca-a1eb-41418c6d6ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-88722365-ffb8ec69f9595621", "content": "A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Fake Zoom installer hides macOS backdoor CloudSyncD CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed Antino Backdoor Lets [\u2026]Security Affairs newsletter Round 598 by Pierluigi Paganini \u2013 INTERNATIONAL EDITION - Security Affairs", "creation_timestamp": "2026-10-04T09:03:29.255526Z"}, {"uuid": "c9819785-516c-4049-8960-9f0b95e4b4e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/mohith808.bsky.social/post/3mx24jqmc5q2n", "content": "POV: you shipped an AI gateway\n\nthe prompt template: \"hi {{name}}\"\n\na logged in user with a crafted flow config: \"what if i was a shell\"\n\ngitlab patched a CVSS 9.9 prompt template sandbox escape in its self-hosted AI gateway (CVE-2026-90970). update to 19.2.4, 19.3.2 or 19.4.1", "creation_timestamp": "2026-10-04T09:45:16.983657Z"}, {"uuid": "df4d7197-2356-4fbf-8c32-36b4a5eefa69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "published-proof-of-concept", "source": "Telegram/tBYy3zrbvDGvS5uG45I7awxIf4mKjhwYypYIjiD8SoZciI4", "content": "", "creation_timestamp": "2026-10-04T07:00:46.000000Z"}, {"uuid": "8512b584-067d-468b-9017-7b11fd790689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mx2lvy3mrc24", "content": "CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed\n\nGitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tra\u2026\n#hackernews #news", "creation_timestamp": "2026-10-04T14:20:33.888308Z"}, {"uuid": "695074bc-7cf3-4816-a333-8ed886d1c9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mx3met2er22g", "content": "GitLab AI Gateway\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\uff1aCVE-2026-90970 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "creation_timestamp": "2026-10-05T00:01:33.167647Z"}, {"uuid": "b5bca28e-f033-44f1-b839-59644bca9d73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/densuke.bsky.social/post/3mx3xhtjmx322", "content": "\u66f4\u65b0\u3055\u308c\u305f\u3088\u3001\u898b\u306b\u6765\u3066\u306d!\u2192 \n\nAI \u306e\u8db3\u5143\u306b\u53e4\u5178\u7684\u306a\u7a74? GitLab AI Gateway CVE-2026-90970\u30fbZammad\u30fbZig 0.17\u30fbUbuntu 26.10 Sequoia PGP\u30fbArm TLBI Domains\uff082026/10/5 Linux\u30fbOSS\u30c8\u30ec\u30f3\u30c9\uff09 https://blog.fuga.jp/posts/2026-10-05-linux-oss-trend/", "creation_timestamp": "2026-10-05T03:20:06.987830Z"}, {"uuid": "846441c3-8643-4d9d-b43f-1cd06fd65068", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/Russian_OSINT/8003", "content": "\u2757\ufe0fGitLab \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 \u2194\ufe0fCVSS 9,9 \u0432 \u0418\u0418-\u0448\u043b\u044e\u0437\u0435 \u0434\u043b\u044f Duo\n\n\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 GitLab AI Gateway \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-90970, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0443 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 9,9 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS 3.1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0443 CWE \u043a\u0430\u043a CWE-1336. \u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GitLab Duo Agent Platform, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u043f\u0440\u043e\u043c\u043f\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u043e\u043a\u0430. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 GitLab AI Gateway.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 GitLab AI Gateway \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0439 19.2.4, 19.3.2, 19.4.1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0432\u0435\u0442\u043a\u043e\u0439.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-10-05T08:00:17.000000Z"}, {"uuid": "cdb2814c-937c-4c6d-8dba-19dc02c2c736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/CyberSecurityIL/9583", "content": "\u05d2\u05d9\u05d8\u05dc\u05d0\u05d1 \u05de\u05d6\u05d4\u05d9\u05e8\u05d4 \u05de\u05e4\u05e0\u05d9 \u05d7\u05d5\u05dc\u05e9\u05d4 \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1-AI Gateway \u05e9\u05dc\u05d4, \u05e9\u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d4\u05e8\u05e6\u05ea \u05e4\u05e7\u05d5\u05d3\u05d5\u05ea \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4, CVE-2026-90970 \u05e2\u05dd CVSS 9.9 \u05de\u05e9\u05e4\u05d9\u05e2\u05d4 \u05e2\u05dc \u05d4\u05ea\u05e7\u05e0\u05d5\u05ea Self-Hosted \u05e9\u05dc GitLab AI Gateway. \n\n\u05d2\u05d9\u05d8\u05dc\u05d0\u05d1 \u05e4\u05e8\u05e1\u05de\u05d4 \u05ea\u05d9\u05e7\u05d5\u05e0\u05d9\u05dd \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 19.2.4, 19.3.2 \u05d5-19.4.1. \n\u05dc\u05e7\u05d5\u05d7\u05d5\u05ea \u05e9\u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd \u05d1-AI Gateway \u05de\u05e0\u05d5\u05d4\u05dc \u05dc\u05d0 \u05e0\u05d3\u05e8\u05e9\u05d9\u05dd \u05dc\u05d1\u05e6\u05e2 \u05e2\u05d3\u05db\u05d5\u05df.\n\nhttps://t.me/CyberSecurityIL/9583", "creation_timestamp": "2026-10-05T09:38:06.000000Z"}, {"uuid": "c627f540-b58c-45af-80bf-ba3310d5f737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mx524qu3pi26", "content": "\ud83d\udd17 CVE : CVE-2026-90970", "creation_timestamp": "2026-10-05T13:40:12.564003Z"}, {"uuid": "678dc4dc-8c40-48cc-9910-c32abc566be9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "Telegram/ELm8PgQpllbXA_VH21iOqLKTsdjbs5AcKNDqc-vEf4a8Tt0", "content": "", "creation_timestamp": "2026-10-03T21:00:05.000000Z"}, {"uuid": "d0b8cf7a-fec4-4780-954c-7df607104927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/CyberSecurityIL/87661", "content": "\u05d2\u05d9\u05d8\u05dc\u05d0\u05d1 \u05de\u05d6\u05d4\u05d9\u05e8\u05d4 \u05de\u05e4\u05e0\u05d9 \u05d7\u05d5\u05dc\u05e9\u05d4 \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1-AI Gateway \u05e9\u05dc\u05d4, \u05e9\u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d4\u05e8\u05e6\u05ea \u05e4\u05e7\u05d5\u05d3\u05d5\u05ea \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4, CVE-2026-90970 \u05e2\u05dd CVSS 9.9 \u05de\u05e9\u05e4\u05d9\u05e2\u05d4 \u05e2\u05dc \u05d4\u05ea\u05e7\u05e0\u05d5\u05ea Self-Hosted \u05e9\u05dc GitLab AI Gateway. \n\n\u05d2\u05d9\u05d8\u05dc\u05d0\u05d1 \u05e4\u05e8\u05e1\u05de\u05d4 \u05ea\u05d9\u05e7\u05d5\u05e0\u05d9\u05dd \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 19.2.4, 19.3.2 \u05d5-19.4.1. \n\u05dc\u05e7\u05d5\u05d7\u05d5\u05ea \u05e9\u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd \u05d1-AI Gateway \u05de\u05e0\u05d5\u05d4\u05dc \u05dc\u05d0 \u05e0\u05d3\u05e8\u05e9\u05d9\u05dd \u05dc\u05d1\u05e6\u05e2 \u05e2\u05d3\u05db\u05d5\u05df.\n\nhttps://t.me/CyberSecurityIL/9583", "creation_timestamp": "2026-10-05T09:38:06.000000Z"}, {"uuid": "5f33ff6d-3dea-4790-bd8c-73f5ace33e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23", "content": "~Checkpoint~\nActive exploitation, ransomware, phishing, AI-enabled attacks and major breaches reported.\n-\nIOCs: CVE-2026-76504, CVE-2026-88771, CVE-2026-90970\n-\n#CVE #Ransomware #ThreatIntel", "creation_timestamp": "2026-10-05T16:08:18.544767Z"}, {"uuid": "f51af270-5deb-4373-b3d9-832a09daf991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "published-proof-of-concept", "source": "Telegram/ELm8PgQpllbXA_VH21iOqLKTsdjbs5AcKNDqc-vEf4a8Tt0", "content": "", "creation_timestamp": "2026-10-03T21:00:05.000000Z"}, {"uuid": "2e39c102-32b4-4993-855b-d54ba2b3d96a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/xakep_ru/20169", "content": "\u0412 GitLab AI Gateway \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0431\u0430\u0433 \u043d\u0430 9,9 \u0431\u0430\u043b\u043b\u0430\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-90970, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 AI Gateway. \u0411\u0430\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u043b 9,9 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0445\u043e\u0441\u0442\u044f\u0442 AI Gateway.\n\nhttps://xakep.ru/2026/10/05/ai-gateway-patch/", "creation_timestamp": "2026-10-05T17:40:34.000000Z"}, {"uuid": "f94f6ec2-c9b2-4ad7-99b7-05d447aeebc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/true_secator/8677", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 AI Gateway, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\nAI Gateway - \u044d\u0442\u043e \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c GitLab Duo, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0418\u0418.\n\nGitLab \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 AI Gateway, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0434\u043b\u044f GitLab.com, GitLab Self-Managed \u0438 GitLab Dedicated, \u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u043d\u0430 GitLab Self-Managed \u0447\u0435\u0440\u0435\u0437 GitLab Duo Self-Hosted.\n\nCVE-2026-90970 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Duo Agent \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432 \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043e\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0442\u043e\u043a\u0430, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 AI Gateway.\n\nGitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u0435\u0440\u0441\u0438\u0438 19.2.4, 19.3.2 \u0438 19.4.1 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Self-Hosted AI Gateway. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 AI Gateway, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 GitLab, \u0443\u0436\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u0438 \u0438\u043c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043b\u0430\u0441\u044c \u0441 \u0442\u0435\u043c\u0438, \u043a\u0442\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0448\u043b\u044e\u0437\u044b \u0418\u0418, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b.\n\n\u041f\u043e\u043a\u0430 \u043d\u0435\u044f\u0441\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 CVE-2026-85706 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0438 \u043f\u043e\u043f\u0430\u043b\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV CISA.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c, \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c CISA, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043e\u0434\u043d\u0430 - \u0431\u0430\u043d\u0434\u0430\u043c\u0438, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0438\u043c\u0438\u0441\u044f \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c.", "creation_timestamp": "2026-10-05T15:00:07.000000Z"}, {"uuid": "7a0e82c6-e61c-4ccc-94b1-31792a4cdf86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90970", "type": "seen", "source": "https://t.me/VictoryDrones/66172", "content": "\u2757\ufe0fGitLab \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 \u2194\ufe0fCVSS 9,9 \u0432 \u0418\u0418-\u0448\u043b\u044e\u0437\u0435 \u0434\u043b\u044f Duo\n\n\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 GitLab AI Gateway \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-90970, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0443 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 9,9 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS 3.1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0443 CWE \u043a\u0430\u043a CWE-1336. \u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GitLab Duo Agent Platform, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u043f\u0440\u043e\u043c\u043f\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u043e\u043a\u0430. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 GitLab AI Gateway.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 GitLab AI Gateway \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0439 19.2.4, 19.3.2, 19.4.1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0432\u0435\u0442\u043a\u043e\u0439.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-10-05T21:33:17.000000Z"}]}