# @zereight/mcp-gitlab multiple safety-control bypasses

Source: https://junglewise.ai/threats/zereight-mcp-gitlab-multiple-safety-control-bypasses-fcdfc95d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-09-15

@zereight/mcp-gitlab is a tool that exposes GitLab APIs to AI agents through Model Context Protocol (MCP), intended to operate in read-only mode with project allow-lists and authentication as guardrails. Five distinct defects defeat these safety controls: an attacker can bypass read-only restrictions and project scoping to perform arbitrary writes, access the service without proper authentication via DNS rebinding, exhaust available sessions to deny service, and inject malicious instructions through CI logs. This undermines the security model when running LLM agents against sensitive GitLab repositories.

Technologies: [@zereight/mcp-gitlab (npm)](https://junglewise.ai/threats/technologies/zereight-mcp-gitlab), [Zereight Mcp-Gitlab](https://junglewise.ai/threats/technologies/mcp-gitlab). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Zereight](https://junglewise.ai/threats/vendors/zereight).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 15 September 2026.

**Which products and versions are affected?** @zereight/mcp-gitlab (npm) SEMVER:introduced=0,fixed=2.1.30; Zereight Mcp-Gitlab <2.1.30.

**Is there a fix for This vulnerability?** Yes. @zereight/mcp-gitlab (npm): upgrade to 2.1.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected?** Check whether you run @zereight/mcp-gitlab (npm) or Zereight Mcp-Gitlab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @zereight/mcp-gitlab (npm): upgrade to 2.1.30 or later

  ```sh
  npm install @zereight/mcp-gitlab@2.1.30
  ```


## Technical details

The vulnerability consists of five independently exploitable defects in @zereight/mcp-gitlab (versions <2.1.30): (F1) The execute_graphql handler is listed as read-only but can execute write operations because the detection regex fails to handle leading commas in GraphQL documents (treated as insignificant by GraphQL parsers but not stripped by the detector), and never enforces GITLAB_ALLOWED_PROJECT_IDS scoping, allowing writes to any project the server token can access. (F2/F3) The Streamable HTTP (/mcp) and SSE transports are unauthenticated by default when configured with --cookie-path or --use-oauth, allowing any network caller to execute commands with the server's GitLab credentials; SSE also lacks DNS-rebinding protections, enabling attacker-controlled web pages on loopback to drive the local server. (F4) The validateToken function performs only syntactic checks (length ≥20 and charset) with no upstream verification, and new sessions are admitted purely on capacity (default 1000 slots); garbage-token floods exhaust all slots for 3600 seconds, returning 503 to legitimate users. (F5) CI job traces are returned verbatim to the model, allowing attacker-influenced logs (e.g. from fork PRs) to inject instructions into model context and, combined with F1, escalate to arbitrary writes. Attack vectors include network access (direct or DNS rebinding), prompt injection, and malicious MCP clients. Patches are available in version 2.1.30.

## Affected products

- zereight @zereight/mcp-gitlab <2.1.30

## Timeline

- 2026-09-15: disclosed
- 2026-07-05: patched: Version 2.1.30 released with all fixes

## References

- [https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-5648-rgj9-v224](https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-5648-rgj9-v224)
- [https://github.com/zereight/gitlab-mcp/issues/596](https://github.com/zereight/gitlab-mcp/issues/596)
- [https://github.com/zereight/gitlab-mcp/issues/748](https://github.com/zereight/gitlab-mcp/issues/748)
- [https://github.com/zereight/gitlab-mcp/pull/571](https://github.com/zereight/gitlab-mcp/pull/571)
- [https://github.com/zereight/gitlab-mcp/pull/624](https://github.com/zereight/gitlab-mcp/pull/624)
- [https://github.com/zereight/gitlab-mcp/commit/69e784da33e96e64867b511c6f14d3f21f91ba8b](https://github.com/zereight/gitlab-mcp/commit/69e784da33e96e64867b511c6f14d3f21f91ba8b)
- [https://github.com/zereight/gitlab-mcp](https://github.com/zereight/gitlab-mcp)

## Related threats

- [@zereight/mcp-gitlab unauthenticated arbitrary file read via upload_markdown](https://junglewise.ai/threats/cve-2026-61560-zereight-mcp-gitlab-unauthenticated-arbitrary-file-read-via)
- [@zereight/mcp-gitlab DNS rebinding in Streamable HTTP transport](https://junglewise.ai/threats/cve-2026-61568-zereight-mcp-gitlab-dns-rebinding-in-streamable-http-transport)
- [zereight mcp-gitlab server-side request forgery in X-GitLab-API-URL](https://junglewise.ai/threats/cve-2026-61559-zereight-mcp-gitlab-server-side-request-forgery-in-dynamic-api)
- [zereight mcp-gitlab path traversal in job_id and pipeline_id](https://junglewise.ai/threats/cve-2026-61462-zereight-mcp-gitlab-path-traversal-in-job-id-and-pipeline-id)