CVE-2026-61559: zereight mcp-gitlab server-side request forgery in X-GitLab-API-URL

CVE-2026-61559 · Severity: critical · CVSS 9.6 · Published 2026-09-15

The @zereight/mcp-gitlab MCP server, when configured with dynamic API URL support enabled, accepts an HTTP header (X-GitLab-API-URL) that can redirect the server's outbound API calls to an attacker-controlled host. The server then forwards the victim's GitLab authentication token to that host in a single request, allowing the attacker to steal credentials and gain full API access to all GitLab repositories, CI/CD pipelines, and secrets under the victim's account.

Technologies: @zereight/mcp-gitlab (npm), Zereight Mcp-Gitlab. Vendors: npm, Zereight.

Quick answers

Is CVE-2026-61559 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61559 being exploited in the wild.
How severe is CVE-2026-61559?
Critical severity, with a CVSS score of 9.6, published 15 September 2026.
Which products and versions are affected?
@zereight/mcp-gitlab (npm) >= 0.0.1, < 2.1.27, SEMVER:introduced=0.0.1,fixed=2.1.27; Zereight Mcp-Gitlab >= 0.0.1, < 2.1.27, 0.0.1 through 2.1.26.
Is there a fix for CVE-2026-61559?
Yes. @zereight/mcp-gitlab (npm): upgrade to 2.1.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61559 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61559?
Check whether you run @zereight/mcp-gitlab (npm) or Zereight Mcp-Gitlab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @zereight/mcp-gitlab (npm): upgrade to 2.1.27 or later
    npm install @zereight/mcp-gitlab@2.1.27

Technical details

This is a server-side request forgery (SSRF) vulnerability in the mcp-gitlab package's dynamic API URL feature. When ENABLE_DYNAMIC_API_URL environment variable is set to true, the server reads the X-GitLab-API-URL HTTP header from incoming requests and uses it as the base URL for GitLab API calls. The vulnerable code at index.ts:11541 (SSE handler) and index.ts:11787 (Streamable HTTP handler) performs only URL syntax validation (new URL()) but applies no hostname allowlist or restriction. The validated URL is then passed to getFetchConfig(), which attaches the victim's Private-Token header to all outbound fetches. An attacker with network access to the HTTP transport can set X-GitLab-API-URL to any attacker-controlled host, causing the server to send the victim's GitLab Personal Access Token or CI/CD job token to that host in the first API request. The feature is intended for supporting self-hosted GitLab instances but lacks any mechanism to distinguish legitimate URLs from attacker hosts. Patched in version 2.1.27.

Affected products

  • zereight mcp-gitlab >= 0.0.1, < 2.1.27

Identifiers

  • CVE-2026-61559
  • GHSA-2h44-8472-frjj

Timeline

  • 2026-06-07: disclosed: Reported via GitHub Security Advisory
  • 2026-07-01: advisory: Published to GitHub Advisory Database
  • 2026-09-15: patched: Version 2.1.27 released with fix
  • 2026-09-15: kev added: Added to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.