What happened
CVE-2026-90970 requires an authenticated user with Duo Agent Platform access. GitLab lists fixed versions 19.2.4, 19.3.2 and 19.4.1 and urges affected self-hosted customers to update. Its hosted gateway was already remediated, with no customer action required. The dated October 2 report links the original advisory.
Why it matters
The distinction is deployment-specific: using GitLab does not automatically mean running a vulnerable self-hosted gateway. Operators should match their installation to the vendor advisory and verify the installed fix.
What to watch
Watch official follow-up guidance. This report does not establish active exploitation of this particular vulnerability.
Sources & verification
Source links are not a count of independent confirmations.
01Report a correction
Help us get it right
Include the disputed statement and, if possible, a supporting source URL. Please do not send personal or sensitive information.
-00.06.31.698.png)
