CVE-2026-1868 AI Gateway Jinja2 Template Injection

CVE-2026-1868 is a critical-severity vulnerability. AttackerView checks GitLab sites for it with a live exploit check.

Deterministic critical GitLab Added 8mo ago cve-verified-cve-2026-1868

Is my site vulnerable to CVE-2026-1868?

Confirms the GitLab AI Gateway's Duo Workflow Service evaluates user-supplied Jinja2 template expressions without blocking callables or dangerous operators. A math canary (41*271=11111) proves arbitrary expression evaluation, enabling remote code execution on the AI Gateway server.

Related GitLab exploits

CVE-2026-3857 GraphQL CSRF — Arbitrary Mutation Execution
CVE-2026-1724 Unauthenticated AI Model Token Disclosure
CVE-2025-7659 Web IDE Origin Validation Bypass
CVE-2026-5173 WebSocket Authorization Bypass

Is your app exploitable through CVE-2026-1868?

Scan your domain free