GitLab patched a critical 9.9 severity flaw in its AI Gateway that could let logged-in users run commands on self-hosted servers. Here's who needs to act and how.
If your team runs GitLab's AI Gateway on your own servers, there's something you'll want to check today. GitLab just patched a flaw rated 9.9 out of 10 on the severity scale — and that number alone should get your attention.
Here's the short version: a logged-in user with access to the Duo Agent Platform could, under certain conditions, run commands directly on the gateway itself. That's not a small thing. It's the kind of flaw that turns a helpful AI integration into an open door.
### What Exactly Is the AI Gateway?
Think of the AI Gateway as the bridge between your GitLab instance and the AI models it talks to. It's the middleman that handles requests, passes context back and forth, and keeps everything connected.
Here's the catch, though — only organizations that host their own gateway need to act. If you're on GitLab's cloud offering, this one probably isn't your problem. But if you're running self-hosted infrastructure, keep reading.
### Who's Actually at Risk?
The advisory is pretty specific. You're affected if:
- You host your own GitLab AI Gateway
- You have the Duo Agent Platform enabled
- Users with valid access could potentially trigger the flaw
The key phrase here is "logged-in user with access." This isn't a random stranger on the internet breaking in. It's someone who already has legitimate credentials. That distinction matters because it changes how you think about your threat model.
### The Fix Is Already Out
GitLab didn't sit on this one. The patch landed in gateway versions 19.2.4, 19.3.2, and 19.4.1. If you're on anything older, you're exposed.
Updating is straightforward, but don't just update and forget. After patching, take a few minutes to review who has Duo Agent Platform access in your organization. Least privilege isn't just a buzzword — it's the thing that keeps a flaw like this from becoming a real incident.
### Why a 9.9 Score Deserves Your Attention
Severity scores aren't perfect, but they're a useful signal. A 9.9 means the flaw is remotely exploitable, requires low complexity, and can lead to serious consequences — in this case, command execution on a server that sits close to your AI workflows.
Command execution is one of those phrases that sounds technical but translates to something simple: someone could potentially run whatever they want on that machine. That's the difference between a nuisance and a nightmare.
### A Quick Reality Check
Self-hosted setups give you control, and that control is exactly why they're popular with teams that care about privacy and data residency. But control comes with responsibility. When you run your own gateway, you're the one who has to watch for advisories like this.
So here's your checklist:
- Confirm which gateway version you're running
- Update to 19.2.4, 19.3.2, or 19.4.1
- Audit who has Duo Agent Platform access
- Set a reminder to check advisories monthly, not yearly
It's not glamorous work. But it's the kind of quiet maintenance that keeps your infrastructure boring — and boring is exactly what you want from a server.
As the old security saying goes: "The only truly secure system is one that's powered off, cast in a block of concrete, and sealed in a lead-lined room with armed guards." Since that's not practical, patching promptly is the next best thing.
Stay current, stay cautious, and don't let a 9.9 sit unpatched on your network.
