Junglewise Threat Intelligence

CVE-2026-61559: @zereight/mcp-gitlab server-side request forgery in dynamic API URL

CVE-2026-61559 · Severity: low · CVSS 3.1 · Published 2026-09-15

Executive brief

@zereight/mcp-gitlab is a Model Context Protocol server that integrates GitLab API calls into AI applications. When the ENABLE_DYNAMIC_API_URL feature is enabled, an authenticated attacker can supply a malicious X-GitLab-API-URL header that redirects the server's outbound requests to an attacker-controlled server, causing the server to leak the victim's GitLab authentication token. This stolen token grants full API access to all GitLab repositories, secrets, and CI/CD pipelines under the victim's permission level.

Technical details

A server-side request forgery (SSRF) vulnerability exists in @zereight/mcp-gitlab when ENABLE_DYNAMIC_API_URL is set to true. The vulnerable code at index.ts:11541 and index.ts:11787 reads the X-GitLab-API-URL HTTP header from incoming requests and uses it as the base URL for outbound GitLab API calls without validating the hostname against an allowlist. The server only performs syntax validation via new URL() but applies no host restrictions. When getFetchConfig() constructs outbound requests, it automatically attaches the victim's GitLab Private-Token header to every fetch, including those redirected to the attacker's host. An authenticated attacker can reach the HTTP transport and set X-GitLab-API-URL to point to an attacker-controlled server; any subsequent GitLab API call within that request delivers the victim's token to the attacker. The vulnerability was introduced in version 0.0.1 and affects all versions through commit 74a8c83. A patch was released in version 2.1.27 that implements hostname allowlist validation via the GITLAB_ALLOWED_HOSTS environment variable.

Affected products

  • zereight @zereight/mcp-gitlab 0.0.1 through 2.1.26

Timeline

  • 2026-09-15: disclosed: GHSA-2h44-8472-frjj published
  • 2026-06-07: reported: Vulnerability reported via GitHub Security Advisory
  • 2026-09-15: patched: Fix released in version 2.1.27
  • 2026-09-15: kev added: CVE-2026-61559 assigned

References

Related threats