CVE-2026-1868 (GCVE-0-2026-1868)
Vulnerability from cvelistv5 – Published: 2026-02-09 06:33 – Updated: 2026-02-09 15:46
VLAI
Title
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
Summary
GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GitLab | GitLab AI Gateway |
Affected:
18.1.6 , < 18.6.2
(semver)
Affected: 18.7.0 , < 18.7.1 (semver) Affected: 18.8.0 , < 18.8.1 (semver) cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-09T15:46:36.826269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-09T15:46:45.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "GitLab AI Gateway",
"vendor": "GitLab",
"versions": [
{
"lessThan": "18.6.2",
"status": "affected",
"version": "18.1.6",
"versionType": "semver"
},
{
"lessThan": "18.7.1",
"status": "affected",
"version": "18.7.0",
"versionType": "semver"
},
{
"lessThan": "18.8.1",
"status": "affected",
"version": "18.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz"
}
],
"descriptions": [
{
"lang": "en",
"value": "GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-09T06:33:11.812Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850"
},
{
"url": "https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade self-hosted GitLab AI Gateway to version 18.6.2, 18.7.1, 18.8.1 or above."
}
],
"title": "Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-1868",
"datePublished": "2026-02-09T06:33:11.812Z",
"dateReserved": "2026-02-03T22:33:13.212Z",
"dateUpdated": "2026-02-09T15:46:45.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-1868",
"date": "2026-07-06",
"epss": "0.00496",
"percentile": "0.3899"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-1868\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2026-02-09T07:16:18.250\",\"lastModified\":\"2026-06-17T10:16:38.343\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway.\"},{\"lang\":\"es\",\"value\":\"GitLab ha remediado una vulnerabilidad en el componente Duo Workflow Service de GitLab AI Gateway que afecta a todas las versiones de AI Gateway desde la 18.1.6, 18.2.6, 18.3.1 hasta la 18.6.1, 18.7.0 y 18.8.0, en las que AI Gateway era vulnerable a la expansi\u00f3n insegura de plantillas de datos proporcionados por el usuario a trav\u00e9s de definiciones de flujo (Flow) de Duo Agent Platform manipuladas. Esta vulnerabilidad podr\u00eda utilizarse para causar denegaci\u00f3n de servicio o para obtener ejecuci\u00f3n de c\u00f3digo en el Gateway. Esto se ha corregido en las versiones 18.6.2, 18.7.1 y 18.8.1 de GitLab AI Gateway.\"}],\"affected\":[{\"source\":\"cve@gitlab.com\",\"affectedData\":[{\"vendor\":\"GitLab\",\"product\":\"GitLab AI Gateway\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"18.1.6\",\"lessThan\":\"18.6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"18.7.0\",\"lessThan\":\"18.7.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"18.8.0\",\"lessThan\":\"18.8.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-09T15:46:36.826269Z\",\"id\":\"CVE-2026-1868\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1336\"}]}],\"references\":[{\"url\":\"https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/\",\"source\":\"cve@gitlab.com\"},{\"url\":\"https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850\",\"source\":\"cve@gitlab.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1868\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-09T15:46:36.826269Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-09T15:46:42.070Z\"}}], \"cna\": {\"title\": \"Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*\"], \"vendor\": \"GitLab\", \"product\": \"GitLab AI Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"18.1.6\", \"lessThan\": \"18.6.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"18.7.0\", \"lessThan\": \"18.7.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"18.8.0\", \"lessThan\": \"18.8.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade self-hosted GitLab AI Gateway to version 18.6.2, 18.7.1, 18.8.1 or above.\"}], \"references\": [{\"url\": \"https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850\"}, {\"url\": \"https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1336\", \"description\": \"CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine\"}]}], \"providerMetadata\": {\"orgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"shortName\": \"GitLab\", \"dateUpdated\": \"2026-02-09T06:33:11.812Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-1868\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-09T15:46:45.991Z\", \"dateReserved\": \"2026-02-03T22:33:13.212Z\", \"assignerOrgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"datePublished\": \"2026-02-09T06:33:11.812Z\", \"assignerShortName\": \"GitLab\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…