The finding
CVE-2026-90970 affected GitLab AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. Under certain conditions, an authenticated user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt-template sandbox and achieve arbitrary command execution on the AI Gateway host. GitLab assigned the issue a CVSS 3.1 score of 9.9.
The authority problem
The user could legitimately possess authority to create or configure an AI flow without possessing authority to execute operating-system commands. A machine-interpreted configuration artifact must not inherit authority for every downstream effect its interpreter can be induced to produce.
Authority to configure a system is not authority to escape the configuration boundary.
The authority-layer answer
Authrizd should treat the interpreted consequential effect as a separate authority event. The chain is principal to authority over the artifact, then interpreter, then resolved effect, then independent effect adjudication. A more privileged downstream executor cannot amplify the originating principal's authority.
GitHub implication
The same rule applies to GitHub Actions, workflow files, deployment manifests, repository configuration and other machine-interpreted artifacts. An agent authorized to edit a repository is not automatically authorized to cause every subprocess, network request, secret access or deployment that a downstream interpreter can produce.
Why this matters
As AI systems increasingly generate configuration rather than directly invoke every effect, the interpreter boundary becomes an authority boundary. Secure execution does not remove the need to determine whether the enterprise authorized the resulting effect.
Sources
NEXT STEP