CVE-2026-1868: GitLab AI Gateway RCE Vulnerability

CVE-2026-1868 Overview

A critical template injection vulnerability has been identified in the Duo Workflow Service component of GitLab AI Gateway. This vulnerability affects all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 through 18.6.1, 18.7.0, and 18.8.0. The flaw exists in the handling of user-supplied data through crafted Duo Agent Platform Flow definitions, where insecure template expansion allows attackers to inject malicious payloads.

This vulnerability falls under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), highlighting the dangerous consequences of inadequate input sanitization in template processing systems.

Critical Impact

Successful exploitation could result in Denial of Service (DoS) or achieve remote code execution on the GitLab AI Gateway, potentially compromising the entire AI infrastructure and any connected systems.

Affected Products

• GitLab AI Gateway versions 18.1.6 through 18.6.1
• GitLab AI Gateway version 18.7.0
• GitLab AI Gateway version 18.8.0

Discovery Timeline

• 2026-02-06 - GitLab releases security patch in versions 18.6.2, 18.7.1, and 18.8.1
• 2026-02-09 - CVE CVE-2026-1868 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-1868

Vulnerability Analysis

The vulnerability resides in the Duo Workflow Service component's template expansion functionality. When processing Duo Agent Platform Flow definitions, the service fails to properly sanitize user-supplied input before passing it to the template engine. This insecure template expansion creates an injection point where attackers with low privileges can embed malicious template directives within flow definitions.

The scope-changing nature of this vulnerability means that successful exploitation can impact resources beyond the vulnerable component's security boundary. An attacker exploiting this flaw could potentially break out of the AI Gateway's intended execution context, affecting confidentiality, integrity, and availability of the host system.

Root Cause

The root cause of this vulnerability is improper neutralization of special elements used in the template engine (CWE-1336). The Duo Workflow Service accepts user-controlled input in Duo Agent Platform Flow definitions without adequate validation or escaping of template syntax characters. This allows template expressions embedded in user input to be interpreted and executed by the underlying template engine rather than being treated as literal data.

Attack Vector

The attack can be executed remotely over the network by an authenticated user with low-level privileges. No user interaction is required for exploitation. An attacker would craft a malicious Duo Agent Platform Flow definition containing template injection payloads. When the AI Gateway processes this flow definition, the embedded template directives are expanded and executed, potentially leading to:

1. Denial of Service - Resource exhaustion through recursive template expansion or intentional crashes
2. Remote Code Execution - Execution of arbitrary commands on the Gateway server through template engine-specific exploitation techniques

The vulnerability mechanism involves crafted template expressions within flow definitions that escape the intended data context. When the template engine processes these definitions, it interprets the malicious expressions as legitimate template commands rather than user data. Technical details regarding the specific exploitation methodology can be found in the GitLab AI Assist Work Item.

Detection Methods for CVE-2026-1868

Indicators of Compromise

• Unusual template syntax patterns in Duo Agent Platform Flow definition logs
• Unexpected process spawning or command execution originating from the AI Gateway service
• Memory or CPU spikes associated with the Duo Workflow Service component
• Error logs indicating template parsing failures or recursive expansion attempts

Detection Strategies

• Monitor AI Gateway logs for flow definitions containing template metacharacters such as {{, }}, {%, %}, or similar template delimiters
• Implement application-layer monitoring to detect anomalous requests to the Duo Workflow Service endpoints
• Deploy runtime application self-protection (RASP) to identify template injection attempts in real-time
• Utilize SentinelOne Singularity for endpoint detection to identify post-exploitation behaviors such as unauthorized code execution

Monitoring Recommendations

• Enable verbose logging for the Duo Workflow Service component to capture all flow definition processing events
• Establish baseline metrics for AI Gateway resource utilization to detect DoS-related anomalies
• Configure alerting for any new process creation by the AI Gateway service that deviates from expected behavior
• Implement network monitoring to detect unusual outbound connections from the AI Gateway infrastructure

How to Mitigate CVE-2026-1868

Immediate Actions Required

• Upgrade GitLab AI Gateway to patched versions 18.6.2, 18.7.1, or 18.8.1 immediately
• Audit existing Duo Agent Platform Flow definitions for any suspicious or unauthorized modifications
• Review access controls to restrict who can create or modify flow definitions
• Implement network segmentation to limit the blast radius if the AI Gateway is compromised

Patch Information

GitLab has released patched versions that address this vulnerability:

For detailed patch information and upgrade instructions, refer to the GitLab Patch Release Note.

Workarounds

• Implement strict input validation on all Duo Agent Platform Flow definitions at the application layer before processing
• Deploy a Web Application Firewall (WAF) with rules to block common template injection patterns
• Restrict access to the Duo Workflow Service to only trusted internal networks until patching is complete
• Consider temporarily disabling the Duo Workflow Service if not critical to operations

# Example: Restrict network access to AI Gateway (adjust for your environment)
# Block external access to AI Gateway service port
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP

# Enable enhanced logging for Duo Workflow Service
export GITLAB_AI_GATEWAY_LOG_LEVEL=DEBUG
export GITLAB_AI_GATEWAY_AUDIT_MODE=enabled