GitLab
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19…
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run GitLab, and is every instance on a fixed release (19.2.4, 19.3.2 or 19.4.1, or later)?
- Is any of it reachable from the internet?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-90970- 9.9 · CriticalExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Not listed
- Elevated attack likelihood (~17.5% in 30 days)
- 18.1.6 before 19.2.4, 19.3 before 19.3.2, 19.4 before 19.4.1
- 19.2.4, 19.3.2, 19.4.1
- Not linked from the CVE record
Versions are as the CVE record states them; check the vendor advisory before planning a fix.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- We have released versions 19.2.4, 19.3.2, and 19.4.1 of the These versions contain a critical security fix for
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab92% match confidence · CVE-2026-90970
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:20 UK time
- Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19…
- ProbableSummary fact75% confidence
We have released versions 19.2.4, 19.3.2, and 19.4.1 of the These versions contain a critical security fix for
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-90970