GitLab patched a 9.9-rated flaw in its AI Gateway that could let logged-in users run commands on self-hosted servers. Here's who's affected and how to fix it fast.
GitLab just dropped a security advisory that should make anyone running a self-hosted AI Gateway sit up straight. The flaw carries a CVSS score of 9.9 out of 10 — that's about as close to "drop everything and patch" as it gets.
Here's the short version: under certain conditions, a logged-in user with Duo Agent Platform access could run commands on the gateway itself. Not on their own machine. On yours.
### What's Actually at Stake
Let's break this down without the jargon. The AI Gateway is the bridge between your GitLab instance and the AI models it talks to. If you're self-hosting it, that bridge lives on your infrastructure. A 9.9-rated flaw means someone with the right access could potentially walk across that bridge and start poking around where they shouldn't.
The catch? It only affects organizations that host their own gateway. If you're using GitLab's cloud version, you can breathe. If you're running it on your own servers, keep reading.
### Who Needs to Act
Not everyone. That's the good news buried in the advisory. You're in the clear if:
- You use GitLab.com's managed services
- You haven't enabled the Duo Agent Platform
- Your gateway is fully air-gapped from user access
But if you're self-hosting the gateway and your team uses Duo Agent Platform, this is your problem to fix. Today, ideally.
### The Fix Is Already Out
GitLab didn't sit on this one. The patch landed in gateway versions 19.2.4, 19.3.2, and 19.4.1. If you're on anything older, you're exposed.
Upgrading is straightforward — pull the latest version, restart the service, verify the version number. The whole process takes maybe 15 minutes for most setups. That's a small price for closing a 9.9-rated hole.
> "A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions." — GitLab Security Advisory
### Why This Matters Beyond GitLab
Here's the thing nobody's saying out loud: AI infrastructure is becoming a juicy target. Gateways, model servers, orchestration layers — these are the new front doors. And they're often bolted on quickly without the same security scrutiny as your core services.
GitLab handled this one well. Fast disclosure, clear advisory, patched versions ready. But it's a reminder that every new AI tool you bolt onto your stack adds surface area.
### What to Do Right Now
First, check your gateway version. If it's below 19.2.4, 19.3.2, or 19.4.1 depending on your release track, patch it.
Second, audit who has Duo Agent Platform access. The flaw needs a logged-in user, so limiting that access reduces your exposure window.
Third, set up version monitoring. You shouldn't be finding out about critical patches from a blog post — you should have alerts firing the moment an advisory drops.
### The Bigger Picture
AI gateways aren't going away. They're becoming standard infrastructure, which means they'll attract the same attention firewalls and VPNs do. The organizations that treat them with the same seriousness will sleep better at night.
This particular flaw is patched. But the pattern — new AI service, rushed deployment, critical CVE — is going to repeat. Stay ahead of it.
If you're running self-hosted GitLab with AI features enabled, go check your version. Right now. It takes two minutes, and it might save you a very bad week.
