Hook
On February 2026, GitLab patched CVE-2026-1868. CVSS 9.9. Server-side template injection, CWE-1336, in the Duo Workflow Service. On October 2026, GitLab patched CVE-2026-90970. CVSS 9.9. Server-side template injection, CWE-1336, in the Duo Workflow Service.
Same component. Same vulnerability class. Same maximum score. Eight months apart.
I have sat through enough post-mortems to know what a single critical bug means. It means a mistake. I also know what two identical critical bugs in the same code path mean. It means the mistake was never fixed — only its symptom was. The ledger never lies, only the narrative does.
On its face, this is not a crypto story. It becomes one the moment you follow where crypto's AI agent infrastructure actually runs.
Context
GitLab AI Gateway is not a peripheral tool. It is the control plane for GitLab's Duo agent workflows — the layer brokering connections between an organization's internal GitLab instance and external AI model providers. It holds JWT signing keys. In the vendor's own framing, it is a "central hub" for the organization's AI integrations.
The vulnerability itself is textbook. CWE-1336, server-side template injection. Jinja2-style template placeholders, a sandboxed execution environment, and a sandbox escape. Jinja2's SandboxedEnvironment has been bypassed in public research for more than a decade — through __class__/__mro__/__subclasses__ chains, through cycler, joiner, and namespace objects. There is no novel attack technique here. The novelty is architectural: user-controlled flow configuration data is permitted to flow into a template execution path. Configuration is being treated as executable code.
The timing is not incidental. AI agents are the dominant narrative in crypto this cycle — autonomous DeFi strategists, on-chain execution bots, portfolio managers wired directly to LLM endpoints. A meaningful share of crypto teams self-host GitLab, because sovereign infrastructure fits the culture and avoids dependency on Microsoft's GitHub. Many of those same teams adopted Duo workflows for agent orchestration because it was convenient. The convenience is the attack surface.
A pattern this consistent is rarely an accident. The same analysis notes that vulnerability identification across AI infrastructure is accelerating — a predictable consequence of a new category in its rapid-expansion phase, where security debt surfaces in concentrated bursts.
Core
The mechanics matter less than the recurrence. Let me be precise about what two CVSS 9.9 escapes in eight months actually signal.
First, this is a design flaw, not an implementation bug. The root cause is stated plainly: insufficient sanitization of user-provided flow configuration data. That means the trust boundary was drawn incorrectly at the architecture level. If the template engine were used only for internal variable substitution, safe string interpolation would suffice. Choosing a full template engine — expressions, filters, attribute access — is a decision in which functionality outweighed isolation. That trade-off was never re-examined, which is why the second CVE exists.
Second, the blast radius is not the component. The AI Gateway custodies JWT signing keys and brokers authentication tokens across the organization's AI integrations. Compromise the gateway and you inherit the tokens. This is single-point trust concentration presented as a convenience feature. Trust is a variable I do not solve for — I price it.
Third, and most underweighted: there is no reliable method to determine whether the gateway was compromised before the patch. A CVSS 9.9 authenticated RCE, a patch, and no forensic means to establish prior exploitation. The patch closes the door. It does not tell you whether someone was already inside.
For a crypto fund, that is the operative risk. A compromised AI Gateway is a pivot point. From there, an attacker reaches the internal GitLab instance, the CI/CD pipelines, and — if the team wired its agent stack the way most teams do — the API credentials for exchange connectivity, custodial services, and model providers. My own audit method relies on triangulation: data, document, witness. Here, the witness is silent. There is no log that answers the only question that matters.
The absence of a workaround is the tell. No WAF rule, no configuration flag, no network control mitigates this. The flaw sits on the core code path, which means the only remedy is a version upgrade — and it means the component shipped without defense in depth, without an isolation layer that would have contained a template escape before it reached the host. The recurrence rate is the strongest signal in the entire dataset, and it is the one the vendor's public messaging does not address.
And the self-hosted patch mismatch bites crypto specifically. GitLab patched its hosted instances immediately. Self-managed customers must upgrade manually. Crypto's self-hosting cohort is structurally the slowest to patch — long change-approval cycles, thin security teams, a preference for pinned versions that "just work." The population most exposed is the population least equipped to respond. Due diligence is the only hedge against chaos.
Contrarian
The report calls this "the first critical RCE identified in an AI-specific infrastructure component." Treat that claim as a marketing artifact, not a finding.
RCE vulnerabilities have been disclosed across AI tooling before — inference servers, model-serving frameworks, orchestration layers. "First in an AI specific infrastructure component" survives only because the definition is narrow enough to exclude the prior cases. That is a narrative technique. And the claim arrives with a second tell: the report bundles this CVE with a cross-vendor cluster — Langflow credential theft, Cisco SD-WAN authentication bypass, Zammad data exposure — and names the pattern "trust-through-defaults." That is a coherent framing. It is also a framing that happens to support a product category. Correlation is not causation, and a repeated pattern across vendors does not prove a single shared root cause.
The genuine contrarian point is simpler. The dangerous thing is not this CVE. It is that crypto's AI agent rush is replicating the exact architecture that produced it — user-configurable workflows, template-driven orchestration, credentials pooled at a central gateway. Crypto already fields dozens of agent frameworks chasing the same small pool of users — the same fragmentation that left a hundred Layer2s competing over one user base. Each new framework is another instance of the same design bet, and the bet is that convenience will not be exploited. Alpha hides in the variance, not the volume — and the variance here is architectural, not volumetric.
Takeaway
Watch the recurrence, not the patch. The signal to monitor over the next two quarters is whether a third CWE-1336 escape lands in the same component. If it does, the root cause was never remediated — only suppressed. For crypto teams running self-hosted GitLab with Duo workflows enabled, the immediate question is not whether you are vulnerable. It is whether you can prove you were not.