Summary
GitLab has patched a critical remote code execution vulnerability in its AI Gateway service, a component introduced to provide AI-assisted development features across the GitLab DevOps platform. The vulnerability allowed unauthenticated remote code execution through the AI Gateway. GitLab has released a patch and users should update immediately.
Timeline
| Date | Event |
|---|---|
| Oct 3, 2026 | GitLab patches critical RCE in AI Gateway service; patch released |
What Happened
GitLab’s AI Gateway is the service layer connecting the DevOps platform to AI model providers for code review, merge request summaries, and other AI features. The service has privileged access to repository content and CI/CD pipeline data. A remote code execution vulnerability in the AI Gateway gives an attacker code execution in a component with this privileged access, potentially exposing source code, CI/CD secrets, and deployment credentials across all projects on the affected instance.
This vulnerability is consistent with the pattern documented across multiple TTO bulletins of AI service components introducing new exploitable attack surfaces into enterprise software.
Domain Intelligence
gitlab.com — 72.79
gitlab.com scores at 72.79. GitLab is the vendor of the affected platform.