CVE-2026-61559
CriticalCVSS 9.6Summary
The @zereight/mcp-gitlab MCP server, in versions from 0.0.1 to 2.1.26 with ENABLE_DYNAMIC_API_URL=true, reads the X-GitLab-API-URL HTTP header and uses it as the base URL for outbound GitLab API calls. The server only validates URL format without any allowlist or hostname restriction, then attaches the victim's Private-Token to every redirected request. Version 2.1.27 contains a patch.
Risk Assessment
An attacker with access to the HTTP transport can redirect server requests to an attacker-controlled host and steal the victim's GitLab token, leading to full GitLab privilege takeover. The risk is high because no authentication is required from the attacker.
Recommendation
Upgrade @zereight/mcp-gitlab to version 2.1.27 or later. If dynamic URL functionality is not needed, disable ENABLE_DYNAMIC_API_URL and restrict network access to the MCP server.
Other vulnerabilities in @zereight/mcp-gitlab
See all- CVE-2026-61560Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project.
- CVE-2026-61568Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`.
Original NVD description (English source)
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.