Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61559— @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Quick assessment

Affected
zereight gitlab-mcp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于 GitLab 的模型上下文协议（MCP）服务器。从版本 0.0.1 开始到 2.1.27 之前，当设置了环境变量 时，服务器会读取 HTTP 请求头 ，并将其作为该请求内所有出站 GitLab API 调用的基础 URL。服务器仅校验该值是否为格式正确的 URL（通过 ），但未施加任何允许列表或主机名限制。随后，服务器会在每个使用该重定向 URL 的出站 fetch 请求中附带受害者的 。任何能够访问该 HTTP 传输层的调用者，都可以将 设置为攻击者可控的主机名。服务器下次发起的 GitLab API

CVSS 9.6 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61559

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zereight gitlab-mcp >= 0.0.1, < 2.1.27 -

II. Public POCs for CVE-2026-61559

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61559

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61559 (2)

Vendor Advisories for CVE-2026-61559 (1)

Vendor Pages for CVE-2026-61559 (1)

Same Patch Batch · zereight · 2026-09-15 · 3 CVEs total

CVE-2026-61560 9.8 CRITICAL @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables P
CVE-2026-61568 9.6 CRITICAL @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

IV. Related Vulnerabilities

Same product: gitlab-mcp
Same vendor: zereight
Same weakness: CWE-918

V. Comments for CVE-2026-61559

No comments yet

Leave a comment