Multiple Safety-Control Bypasses in @zereight/mcp-gitlab

The @zereight/mcp-gitlab package (version < 2.1.30) contains multiple high-severity security defects that defeat the tool's intended safety controls. The package is designed to expose GitLab functionality to LLM agents using read-only mode, project allow-lists, and transport authentication. A source review identified five critical flaws: a GraphQL query parser bypass that allows write operations in read-only mode and ignores project allow-lists; flawed authentication gates that allow unauthenticated access when specific flags are enabled; missing Origin/Host validation making the service susceptible to DNS rebinding; an unauthenticated session-exhaustion denial-of-service (DoS) vulnerability; and the verbatim exposure of CI job traces to LLMs. These vulnerabilities allow malicious clients or prompt-injected LLM agents to execute arbitrary write commands on GitLab, impersonate the server's session, or disrupt service availability.

Attack Chain

1. An attacker identifies a target running a vulnerable instance of @zereight/mcp-gitlab on a local or accessible network.
2. The attacker exploits missing DNS rebinding protections (F3) by hosting a malicious website that performs a DNS rebind to access the local MCP service.
3. The attacker bypasses authentication (F2) due to the flawed authentication gate logic, allowing interaction with the MCP service without valid credentials.
4. The attacker sends a crafted GraphQL request through the execute_graphql tool.
5. The attacker prepends a comma to the GraphQL document (e.g., ,mutation{...}) to bypass the flawed graphqlQueryContainsWriteOperation check (F1).
6. The service executes the mutation against the connected GitLab instance, ignoring intended read-only and project-scope restrictions.
7. The attacker repeats unauthorized initialize requests with garbage tokens to exhaust session slots, resulting in a DoS (F4).

Impact

Successful exploitation allows for arbitrary unauthorized write operations on GitLab projects, potentially leading to data manipulation or destruction. By leveraging the server's live session, an attacker can access sensitive information, perform repository changes, or interact with CI/CD pipelines outside the intended scope. The unauthenticated DoS vulnerability enables service disruption with minimal request volume, effectively disabling the LLM agent integration.

Recommendation

Prioritized actions for security teams:

• Immediately upgrade @zereight/mcp-gitlab to version 2.1.30 or later to patch the identified safety control bypasses and DoS conditions.
• Implement network-level access controls to restrict access to the MCP server to authorized users or service identities, mitigating the risks posed by the unauthenticated transport and DNS rebinding vulnerabilities (F2/F3).
• Review and harden GitLab project-level permissions to ensure that the token used by the MCP server follows the principle of least privilege, limiting the blast radius of any successful GraphQL injection (F1).
• Configure the MCP service to use a strictly defined SSE_AUTH_TOKEN and disable remote access unless explicitly required and secured by robust reverse-proxy authentication (F3).