Junglewise Threat Intelligence

@zereight/mcp-gitlab multiple safety-control bypasses

Severity: low · CVSS 3.1 · Published 2026-09-15

Executive brief

@zereight/mcp-gitlab is a tool that exposes GitLab APIs to AI agents through Model Context Protocol (MCP), intended to operate in read-only mode with project allow-lists and authentication as guardrails. Five distinct defects defeat these safety controls: an attacker can bypass read-only restrictions and project scoping to perform arbitrary writes, access the service without proper authentication via DNS rebinding, exhaust available sessions to deny service, and inject malicious instructions through CI logs. This undermines the security model when running LLM agents against sensitive GitLab repositories.

Technical details

The vulnerability consists of five independently exploitable defects in @zereight/mcp-gitlab (versions <2.1.30): (F1) The execute_graphql handler is listed as read-only but can execute write operations because the detection regex fails to handle leading commas in GraphQL documents (treated as insignificant by GraphQL parsers but not stripped by the detector), and never enforces GITLAB_ALLOWED_PROJECT_IDS scoping, allowing writes to any project the server token can access. (F2/F3) The Streamable HTTP (/mcp) and SSE transports are unauthenticated by default when configured with --cookie-path or --use-oauth, allowing any network caller to execute commands with the server's GitLab credentials; SSE also lacks DNS-rebinding protections, enabling attacker-controlled web pages on loopback to drive the local server. (F4) The validateToken function performs only syntactic checks (length ≥20 and charset) with no upstream verification, and new sessions are admitted purely on capacity (default 1000 slots); garbage-token floods exhaust all slots for 3600 seconds, returning 503 to legitimate users. (F5) CI job traces are returned verbatim to the model, allowing attacker-influenced logs (e.g. from fork PRs) to inject instructions into model context and, combined with F1, escalate to arbitrary writes. Attack vectors include network access (direct or DNS rebinding), prompt injection, and malicious MCP clients. Patches are available in version 2.1.30.

Affected products

  • zereight @zereight/mcp-gitlab <2.1.30

Timeline

  • 2026-09-15: disclosed
  • 2026-07-05: patched: Version 2.1.30 released with all fixes

References

Related threats