{"id":11274,"date":"2026-10-04T00:11:47","date_gmt":"2026-10-04T00:11:47","guid":{"rendered":"https:\/\/bitep.net\/blog\/2026\/10\/04\/gitlab-ai-gateway-xidm%c9%99tind%c9%99ki-kritik-rce-z%c9%99ifliyi-bar%c9%99d%c9%99-x%c9%99b%c9%99rdarl%c4%b1q-edir\/"},"modified":"2026-10-04T00:11:47","modified_gmt":"2026-10-04T00:11:47","slug":"gitlab-ai-gateway-xidm%c9%99tind%c9%99ki-kritik-rce-z%c9%99ifliyi-bar%c9%99d%c9%99-x%c9%99b%c9%99rdarl%c4%b1q-edir","status":"publish","type":"post","link":"https:\/\/bitep.net\/blog\/2026\/10\/04\/gitlab-ai-gateway-xidm%c9%99tind%c9%99ki-kritik-rce-z%c9%99ifliyi-bar%c9%99d%c9%99-x%c9%99b%c9%99rdarl%c4%b1q-edir\/","title":{"rendered":"GitLab AI Gateway xidm\u0259tind\u0259ki kritik RCE z\u0259ifliyi bar\u0259d\u0259 x\u0259b\u0259rdarl\u0131q edir"},"content":{"rendered":"<h2>GitLab AI Gateway Xidm\u0259tind\u0259 Kritik RCE Z\u0259ifliyi A\u015fkarlan\u0131b: CVE-2026-90970<\/h2>\n<p>DevOps v\u0259 proqram t\u0259minat\u0131 idar\u0259etm\u0259 platformas\u0131 GitLab, s\u00fcni intellekt \u0259sasl\u0131 &#8220;GitLab Duo&#8221; imkanlar\u0131n\u0131 t\u0259min ed\u0259n &#8220;AI Gateway&#8221; xidm\u0259tind\u0259 kritik t\u0259hl\u00fck\u0259sizlik bo\u015flu\u011fu bar\u0259d\u0259 x\u0259b\u0259rdarl\u0131q yay\u0131mlay\u0131b. A\u015fkarlanan z\u0259iflik t\u0259cav\u00fczkarlara t\u0259crid olunmu\u015f m\u00fchitd\u0259n k\u0259nara \u00e7\u0131xaraq h\u0259d\u0259f serverl\u0259rd\u0259 uzaqdan ixtiyari kod icra etm\u0259y\u0259 (Remote Code Execution &#8211; RCE) \u015f\u0259rait yarad\u0131r.<\/p>\n<h3>Z\u0259ifliyin Texniki Mahiyy\u0259ti v\u0259 T\u0259hl\u00fck\u0259 S\u0259viyy\u0259si<\/h3>\n<p>T\u0259hl\u00fck\u0259sizlik b\u00fclletenin\u0259 \u0259sas\u0259n, bo\u015fluq <strong>CVE-2026-90970<\/strong> identifikatoru il\u0259 qeydiyyata al\u0131n\u0131b v\u0259 <strong>CWE-1336<\/strong> (\u015fablon m\u00fch\u0259rrikind\u0259 x\u00fcsusi elementl\u0259rin d\u00fczg\u00fcn neytralla\u015fd\u0131r\u0131lmamas\u0131) n\u00f6v\u00fcn\u0259 aiddir. Z\u0259iflik GitLab-\u0131n s\u00fcni intellekt sor\u011fular\u0131n\u0131 emal etdiyi prompt \u015fablonu mexanizmind\u0259ki bo\u015fluqdan qaynaqlan\u0131r.<\/p>\n<p>H\u00fccum ssenarisi a\u015fa\u011f\u0131dak\u0131 riskl\u0259ri ehtiva edir:<\/p>\n<ul>\n<li><strong>Sandbox-dan \u00e7\u0131x\u0131\u015f:<\/strong> Duo Agent Platform giri\u015f h\u00fcququna malik olan autentifikasiyadan ke\u00e7mi\u015f h\u00fccum\u00e7ular x\u00fcsusi formatla\u015fd\u0131r\u0131lm\u0131\u015f ax\u0131n (flow) konfiqurasiyas\u0131 t\u0259qdim ed\u0259 bil\u0259rl\u0259r.<\/li>\n<li><strong>Sistem s\u0259viyy\u0259sind\u0259 kod icras\u0131:<\/strong> Bu konfiqurasiya prompt \u015fablonunun t\u0259crid olunmu\u015f sandbox m\u00fchitini a\u015faraq, birba\u015fa \u0259m\u0259liyyat sistemi s\u0259viyy\u0259sind\u0259 ixtiyari \u0259mrl\u0259rin i\u015f\u0259 sal\u0131nmas\u0131na yol a\u00e7\u0131r.<\/li>\n<li><strong>\u0130nfrastrukturun \u0259l\u0259 ke\u00e7irilm\u0259si:<\/strong> RCE h\u00fccumu n\u0259tic\u0259sind\u0259 h\u00fccum\u00e7ular serverd\u0259 yerl\u0259\u015f\u0259n h\u0259ssas m\u0259lumatlar\u0131, s\u00fcni intellekt modell\u0259rinin konfiqurasiyalar\u0131n\u0131 v\u0259 daxili \u015f\u0259b\u0259k\u0259 resurslar\u0131n\u0131 t\u0259hl\u00fck\u0259 alt\u0131na ata bil\u0259rl\u0259r.<\/li>\n<\/ul>\n<h3>T\u0259sirl\u0259n\u0259n M\u00fchitl\u0259r v\u0259 T\u0259hl\u00fck\u0259sizlik V\u0259ziyy\u0259ti<\/h3>\n<p>GitLab t\u0259r\u0259find\u0259n idar\u0259 olunan bulud \u0259sasl\u0131 AI Gateway instansiyalar\u0131 m\u0259rk\u0259zl\u0259\u015fdirilmi\u015f \u015f\u0259kild\u0259 qorunma alt\u0131na al\u0131n\u0131b v\u0259 m\u00fcvafiq t\u0259hl\u00fck\u0259sizlik t\u0259dbirl\u0259ri t\u0259tbiq edilib. Bununla bel\u0259, AI Gateway xidm\u0259tini \u00f6z f\u0259rdi serverl\u0259rind\u0259 yerl\u0259\u015fdir\u0259n (self-hosted) m\u00fc\u015ft\u0259ril\u0259r birba\u015fa t\u0259hl\u00fck\u0259 alt\u0131ndad\u0131r.<\/p>\n<h3>Burax\u0131lan T\u0259hl\u00fck\u0259sizlik Yenil\u0259m\u0259l\u0259ri v\u0259 T\u00f6vsiy\u0259l\u0259r<\/h3>\n<p>GitLab m\u00fch\u0259ndisl\u0259ri bu kritik bo\u015flu\u011fu aradan qald\u0131rmaq m\u0259qs\u0259dil\u0259 x\u00fcsusi t\u0259hl\u00fck\u0259sizlik yenil\u0259m\u0259l\u0259ri yay\u0131mlay\u0131b. Xidm\u0259tin a\u015fa\u011f\u0131dak\u0131 versiyalara d\u0259rhal y\u00fcks\u0259ldilm\u0259si t\u00f6vsiy\u0259 edilir:<\/p>\n<ul>\n<li><strong>19.2.4<\/strong><\/li>\n<li><strong>19.3.2<\/strong><\/li>\n<li><strong>19.4.1<\/strong><\/li>\n<\/ul>\n<p>BITEP.net komandas\u0131 olaraq, infrastrukturunda GitLab AI Gateway h\u0259llini &#8220;self-hosted&#8221; formatda t\u0259tbiq ed\u0259n t\u0259\u015fkilatlara v\u0259 sistem administratorlar\u0131na xidm\u0259tin \u0259n son versiyaya d\u0259rhal yenil\u0259nm\u0259sini, el\u0259c\u0259 d\u0259 Duo Agent Platform \u00e7\u0131x\u0131\u015f icaz\u0259l\u0259rini v\u0259 server loqlar\u0131n\u0131 \u015f\u00fcbh\u0259li f\u0259aliyy\u0259tl\u0259r\u0259 qar\u015f\u0131 yoxlama\u011f\u0131 t\u00f6vsiy\u0259 edirik.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>GitLab AI Gateway Xidm\u0259tind\u0259 Kritik RCE Z\u0259ifliyi A\u015fkarlan\u0131b: CVE-2026-90970 DevOps v\u0259 proqram t\u0259minat\u0131 idar\u0259etm\u0259 platformas\u0131 GitLab, s\u00fcni intellekt \u0259sasl\u0131 &#8220;GitLab Duo&#8221; imkanlar\u0131n\u0131 t\u0259min ed\u0259n &#8220;AI Gateway&#8221; xidm\u0259tind\u0259 kritik t\u0259hl\u00fck\u0259sizlik bo\u015flu\u011fu bar\u0259d\u0259 x\u0259b\u0259rdarl\u0131q yay\u0131mlay\u0131b. A\u015fkarlanan z\u0259iflik t\u0259cav\u00fczkarlara t\u0259crid olunmu\u015f m\u00fchitd\u0259n k\u0259nara \u00e7\u0131xaraq h\u0259d\u0259f serverl\u0259rd\u0259 uzaqdan ixtiyari kod icra etm\u0259y\u0259 (Remote Code Execution &#8211; RCE) \u015f\u0259rait yarad\u0131r. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":11273,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/bitep.net\/blog\/wp-content\/uploads\/2026\/10\/gitlab-ai-gateway-rce-1791072702685.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/comments?post=11274"}],"version-history":[{"count":0,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media\/11273"}],"wp:attachment":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media?parent=11274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/categories?post=11274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/tags?post=11274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}