CVE-2026-1868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1868", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-02-03T22:33:13.212Z", "datePublished": "2026-02-09T06:33:11.812Z", "dateUpdated": "2026-02-09T15:46:45.991Z"}, "containers": {"cna": {"title": "Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway", "descriptions": [{"lang": "en", "value": "GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway."}], "affected": [{"vendor": "GitLab", "product": "GitLab AI Gateway", "cpes": ["cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*"], "versions": [{"version": "18.1.6", "status": "affected", "lessThan": "18.6.2", "versionType": "semver"}, {"version": "18.7.0", "status": "affected", "lessThan": "18.7.1", "versionType": "semver"}, {"version": "18.8.0", "status": "affected", "lessThan": "18.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "cweId": "CWE-1336", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850"}, {"url": "https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "solutions": [{"lang": "en", "value": "Upgrade self-hosted GitLab AI Gateway to version 18.6.2, 18.7.1, 18.8.1 or above."}], "credits": [{"lang": "en", "value": "This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-09T06:33:11.812Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:46:36.826269Z", "id": "CVE-2026-1868", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:46:45.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-09T15:46:36.826269Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:46:42.070Z"}}], "cna": {"title": "Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway", "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*"], "vendor": "GitLab", "product": "GitLab AI Gateway", "versions": [{"status": "affected", "version": "18.1.6", "lessThan": "18.6.2", "versionType": "semver"}, {"status": "affected", "version": "18.7.0", "lessThan": "18.7.1", "versionType": "semver"}, {"status": "affected", "version": "18.8.0", "lessThan": "18.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade self-hosted GitLab AI Gateway to version 18.6.2, 18.7.1, 18.8.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850"}, {"url": "https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-09T06:33:11.812Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1868", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:46:45.991Z", "dateReserved": "2026-02-03T22:33:13.212Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-09T06:33:11.812Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:ai-gateway:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab AI Gateway", "vendor": "GitLab", "versions": [{"lessThan": "18.6.2", "status": "affected", "version": "18.1.6", "versionType": "semver"}, {"lessThan": "18.7.1", "status": "affected", "version": "18.7.0", "versionType": "semver"}, {"lessThan": "18.8.1", "status": "affected", "version": "18.8.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway. This has been fixed in versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway."}, {"lang": "es", "value": "GitLab ha remediado una vulnerabilidad en el componente Duo Workflow Service de GitLab AI Gateway que afecta a todas las versiones de AI Gateway desde la 18.1.6, 18.2.6, 18.3.1 hasta la 18.6.1, 18.7.0 y 18.8.0, en las que AI Gateway era vulnerable a la expansi\u00f3n insegura de plantillas de datos proporcionados por el usuario a trav\u00e9s de definiciones de flujo (Flow) de Duo Agent Platform manipuladas. Esta vulnerabilidad podr\u00eda utilizarse para causar denegaci\u00f3n de servicio o para obtener ejecuci\u00f3n de c\u00f3digo en el Gateway. Esto se ha corregido en las versiones 18.6.2, 18.7.1 y 18.8.1 de GitLab AI Gateway."}], "id": "CVE-2026-1868", "lastModified": "2026-06-17T10:16:38.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1868", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:46:36.826269Z", "version": "2.0.3"}}]}, "published": "2026-02-09T07:16:18.250", "references": [{"source": "cve@gitlab.com", "url": "https://about.gitlab.com/releases/2026/02/06/patch-release-gitlab-ai-gateway-18-8-1-released/"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.1.6,18.6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.7.0,18.7.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.8.0,18.8.1)"}}], "product": "ai-gateway", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-17T21:34:30.731141+00:00", "value": {"mitigation_remediation": ["Upgrade the GitLab AI Gateway to version 18.6.2, 18.7.1, 18.8.1, or any newer release. ", "If an upgrade is not immediately possible, restrict or disable the Duo Workflow Service component and block external access to the gateway\u2019s administration endpoints. ", "Monitor gateway logs for abnormal template expansion activity and alert on any unauthorized flow modifications."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is GitLab AI Gateway. All self\u2011hosted versions from 18.1.6, 18.2.6, 18.3.1 up to and including 18.6.1, 18.7.0, and 18.8.0 are vulnerable. The issue is tracked under the CPE for GitLab AI Gateway and is fixed in releases 18.6.2, 18.7.1, and 18.8.1 or newer.", "description_and_impact": "This vulnerability is an improper neutralization of special elements used in the template engine of GitLab AI Gateway. User supplied data in Duo Agent Platform Flow definitions is insecurely expanded, which can lead to denial of service or execution of arbitrary code on the gateway. The weakness is classified as CWE-1336, indicating a template injection flaw that compromises code integrity and confidentiality.", "risk_and_exploitability": "The CVSS score is 9.9, denoting critical severity. The EPSS score is under 1\u202f%, indicating the likelihood of exploitation is very low at present. It is not listed in the CISA KEV catalog. Based on the description, the attack likely requires an attacker to supply a crafted Duo Workflow definition to the gateway, enabling insecure template expansion. The attack vector appears to be remote via the gateway's API or administrative interface, though the exact path is not explicitly detailed."}}}}, "created": "2026-02-10T12:23:55.805301+00:00", "updated": "2026-04-17T21:45:28.622069+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$ai-gateway"]}