CVE-2026-61568
CriticalCVSS 9.6Summary
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`.
Risk Assessment
An attacker can reach the victim's local MCP server and perform operations on their behalf, potentially leading to unauthorized GitLab access. This may result in data leakage or repository modification.
Recommendation
Update @zereight/mcp-gitlab to version 2.1.30 or later, which contains the patch. Until updated, restrict access to the MCP endpoint and implement Host and Origin header validation.
Other vulnerabilities in @zereight/mcp-gitlab
See all- CVE-2026-61560Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project.
- CVE-2026-61559Critical
The @zereight/mcp-gitlab MCP server, in versions from 0.0.1 to 2.1.26 with ENABLE_DYNAMIC_API_URL=true, reads the X-GitLab-API-URL HTTP header and uses it as the base URL for outbound GitLab API calls. The server only validates URL format without any allowlist or hostname restriction, then attaches the victim's Private-Token to every redirected request. Version 2.1.27 contains a patch.
Original NVD description (English source)
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.