@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zereight | gitlab-mcp | 0.0.1 to before 2.1.27 | 2.1.27 | Patch available | CNA |
| — | @zereight/mcp-gitlab (npm) | 0.0.1 to before 2.1.27 | 2.1.27 | Patch available | GHSA-2h44-8472-frjj |
- gitlab-mcp Vendorzereight Affected 0.0.1 to before 2.1.27 Fixed in 2.1.27 Patch available CNA
- @zereight/mcp-gitlab (npm) Vendor— Affected 0.0.1 to before 2.1.27 Fixed in 2.1.27 Patch available GHSA-2h44-8472-frjj
Remediation
- Fix · CNA gitlab-mcp (zereight) Fixed in 2.1.27
- Fix · GHSA-2h44-8472-frjj @zereight/mcp-gitlab (npm) Fixed in 2.1.27 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61559
- 2026-10-03 Alias added: GHSA-2h44-8472-frjj
References
Other 5
- https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj
- https://github.com/zereight/gitlab-mcp/pull/625
- https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d
- https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27
- https://github.com/zereight/gitlab-mcp
More zereight vulnerabilities
- TI-2026-44112 Path traversal in zereight gitlab-mcp CVSS 3.1CRITICAL 9.8
- TI-2026-44067 mcp-gitlab Path Traversal via job_id Parameter CVSS 4.0CRITICAL 9.2
- TI-2026-44113 @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport CVSS 3.1CRITICAL 9.6
Sources
- CVE-2026-61559 · CVE Program
- CVE-2026-61559 · NVD
- FIRST EPSS
- GHSA-2h44-8472-frjj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences