← All stories
● Covered by 3 sources · 4 reportsMedium impact4 neutral

GitLab Duo Self-Hosted Integrates Microsoft Foundry for AI Model Deployment

🔄 Updated 26d ago — new reporting from InfoQ
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • GitLab Duo Self-Hosted supports Microsoft Foundry models.
  • Organizations can use their own Azure-hosted AI models.
  • Provides control over model provider, deployment, and data path.
  • Addresses data residency and regulatory needs.
  • GitLab issued a warning about a critical RCE vulnerability, CVE-2026-90970.
  • The vulnerability affects self-hosted instances of GitLab's AI Gateway service.
  • The flaw allows authenticated users with basic privileges to execute arbitrary commands.
  • The vulnerability is tracked as CVE-2026-90970.
  • GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to address the vulnerability.
  • The vulnerability has a CVSS score of 9.9 out of 10.
  • GitLab disclosed the vulnerability on October 2.
  • GitLab 19.4 adds a goal-driven mode to GitLab Duo CLI.
  • GitLab 19.4 includes new AI cost controls.
  • GitLab 19.4 adds three hosted open-weight models.
  • GitLab 19.4 includes a larger set of Model Context Protocol (MCP) tools.
  • The new /goal command in GitLab Duo CLI is in public beta.
  • The /goal command accepts an open-ended objective and works until completion or iteration limit.
  • One model implements changes while a separate model checks progress against the goal.

Expanded Self-Hosted AI Capabilities

GitLab has updated GitLab Duo Self-Hosted to include support for models deployed via Microsoft Foundry. This change enables organizations to utilize GitLab's AI development features with models hosted within their own Azure environments, rather than relying on GitLab-managed infrastructure.

The integration covers various model families, including OpenAI GPT, Anthropic Claude, Meta Llama, and Mistral. This offers enterprises increased flexibility in choosing their preferred model provider, deployment location, and managing data flow.

Addressing Data and Regulatory Requirements

This update is particularly beneficial for organizations facing strict data residency, sovereignty, regulatory, or network isolation requirements. By using their own AI Gateway and model deployments, administrators can maintain greater control over the processing of AI requests and responses, as well as the deployment of underlying models.

The architecture involves a self-managed GitLab instance, a self-hosted GitLab AI Gateway, and model endpoints hosted through Microsoft Foundry. The gateway acts as an intermediary, decoupling individual Duo features from specific model providers.

Feature-Level Model Selection

A key aspect of this integration is the ability for organizations to select different models for various GitLab Duo capabilities. For instance, a code-focused model can be used for Code Suggestions, while a different model handles agentic workloads, and a smaller model can be assigned to high-volume tasks. Model deployments can also be modified without altering the GitLab development workflow.

This approach aligns with a broader industry trend of separating AI development tools from foundation models, as Microsoft Foundry itself offers access to models from multiple vendors.

Trade-offs and Responsibilities

While self-hosted AI provides greater flexibility and control, it also shifts more responsibility to engineering and platform teams. These teams become responsible for managing model deployments, capacity, networking, credentials, availability, and the model lifecycle, in addition to the GitLab environment.

Organizations must also verify model compatibility, as Microsoft Foundry's model catalog can change independently of GitLab's supported-model matrix. Model availability in Foundry does not automatically guarantee GitLab Duo compatibility.

Updates

🕒 2026-10-12 · new reporting from InfoQ
  • GitLab 19.4 adds a goal-driven mode to GitLab Duo CLI.
  • GitLab 19.4 includes new AI cost controls.
  • GitLab 19.4 adds three hosted open-weight models.
  • GitLab 19.4 includes a larger set of Model Context Protocol (MCP) tools.
  • The new /goal command in GitLab Duo CLI is in public beta.
  • The /goal command accepts an open-ended objective and works until completion or iteration limit.
  • One model implements changes while a separate model checks progress against the goal.
🕒 2026-10-02 · new reporting from BleepingComputer, The Hacker News
  • GitLab issued a warning about a critical RCE vulnerability, CVE-2026-90970.
  • The vulnerability affects self-hosted instances of GitLab's AI Gateway service.
  • The flaw allows authenticated users with basic privileges to execute arbitrary commands.
  • The vulnerability is tracked as CVE-2026-90970.
  • GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to address the vulnerability.
  • The vulnerability has a CVSS score of 9.9 out of 10.
  • GitLab disclosed the vulnerability on October 2.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~4 min · 3 stories · Nov 07

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

How outlets covered it

GitLab released version 19.4 of its DevSecOps platform, adding a goal-driven mode to GitLab Duo CLI and new AI cost controls. This update allows agents to pursue open-ended objectives within existing project permissions and enables organizations to manage AI spending more effectively.

GitLab has patched a critical vulnerability (CVE-2026-90970) in its AI Gateway, rated 9.9 CVSS, which could allow logged-in users with Duo Agent Platform access to execute commands on self-hosted gateways. This flaw affects organizations that host their own GitLab AI Gateway and requires immediate updates to versions 19.2.4, 19.3.2, or 19.4.1.

GitLab issued a warning about a critical remote code execution (RCE) vulnerability, CVE-2026-90970, in its AI Gateway service, affecting self-hosted instances. The flaw allows authenticated users with basic privileges to execute arbitrary commands, necessitating immediate updates for affected customers.

GitLab Duo Self-Hosted now supports AI models deployed through Microsoft Foundry, allowing organizations to run GitLab's AI development features using models hosted within their own Azure environment. This integration provides enterprises with more control over model providers, deployment locations, and data paths, addressing data residency and regulatory requirements.