Executive brief
@zereight/mcp-gitlab is a Model Context Protocol (MCP) server that exposes GitLab to AI agents and relies on read-only mode, project allow-lists, and authentication as safety controls. Five critical flaws defeat these protections: the execute_graphql tool can perform write operations despite read-only mode and bypass project restrictions; unauthenticated access is possible via HTTP and Server-Sent Events; an attacker can exhaust session slots with trivial requests causing denial of service; and CI job logs (which may contain attacker-controlled content) are returned verbatim to the AI model. These issues allow attackers to modify GitLab data, access repositories outside the configured allow-list, disable the service, and manipulate AI decision-making through prompt injection.
Technical details
Five distinct authorization and authentication bypasses exist in @zereight/mcp-gitlab versions prior to 2.1.30. F1: The execute_graphql GraphQL handler lacks write-operation detection due to insufficient GraphQL parsing—the detector strips comments and strings but misses comma-prefixed mutations (`,mutation{...}`), allowing writes while classified as read-only; additionally, the handler does not enforce the GITLAB_ALLOWED_PROJECT_IDS allow-list, unlike all other tools, permitting access to any project the token can reach. F2: Transport authentication is conditionally enforced only when a PAT or job token is supplied at startup; if started with cookie-path or device-flow OAuth, authentication validation passes and all /mcp requests proceed unauthenticated, with the server proxying its own GitLab session upstream. F3: Server-Sent Events (SSE) authentication defaults to disabled, and DNS rebinding protections are absent, allowing a malicious web page (via DNS rebinding on loopback) to issue authenticated requests using the operator's credentials. F4: Token validation is purely syntactic (checks length ≥20 and character set but never upstream verification); new sessions are admitted on capacity alone (default 1000 slots, 3600 second timeout), so trivial garbage tokens can fill all slots and cause 503 errors for legitimate users. F5: The get_pipeline_job_output handler returns CI logs verbatim to the model; CI logs are attacker-influenceable (e.g., via fork merge-request pipelines), allowing embedded instructions to steer the agent and, combined with F1, escalate to unauthorized writes. Root cause: incomplete parser logic, missing authorization checks, weak token validation, no rate limiting on session allocation, and unrestricted data flow. Patch 2.1.30 is available.
Affected products
- zereight @zereight/mcp-gitlab < 2.1.30
Timeline
- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Version 2.1.30 released with fixes