{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@zereight/mcp-gitlab--2.1.30/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@zereight/mcp-gitlab (\u003c 2.1.30)"],"_cs_severities":["high"],"_cs_tags":["mcp","gitlab","llm-security","supply-chain"],"_cs_type":"advisory","_cs_vendors":["zereight"],"content_html":"\u003cp\u003eThe @zereight/mcp-gitlab package (version \u0026lt; 2.1.30) contains multiple high-severity security defects that defeat the tool's intended safety controls. The package is designed to expose GitLab functionality to LLM agents using read-only mode, project allow-lists, and transport authentication. A source review identified five critical flaws: a GraphQL query parser bypass that allows write operations in read-only mode and ignores project allow-lists; flawed authentication gates that allow unauthenticated access when specific flags are enabled; missing Origin/Host validation making the service susceptible to DNS rebinding; an unauthenticated session-exhaustion denial-of-service (DoS) vulnerability; and the verbatim exposure of CI job traces to LLMs. These vulnerabilities allow malicious clients or prompt-injected LLM agents to execute arbitrary write commands on GitLab, impersonate the server's session, or disrupt service availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target running a vulnerable instance of @zereight/mcp-gitlab on a local or accessible network.\u003c/li\u003e\n\u003cli\u003eThe attacker exploits missing DNS rebinding protections (F3) by hosting a malicious website that performs a DNS rebind to access the local MCP service.\u003c/li\u003e\n\u003cli\u003eThe attacker bypasses authentication (F2) due to the flawed authentication gate logic, allowing interaction with the MCP service without valid credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted GraphQL request through the \u003ccode\u003eexecute_graphql\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eThe attacker prepends a comma to the GraphQL document (e.g., \u003ccode\u003e,mutation{...}\u003c/code\u003e) to bypass the flawed \u003ccode\u003egraphqlQueryContainsWriteOperation\u003c/code\u003e check (F1).\u003c/li\u003e\n\u003cli\u003eThe service executes the mutation against the connected GitLab instance, ignoring intended read-only and project-scope restrictions.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats unauthorized \u003ccode\u003einitialize\u003c/code\u003e requests with garbage tokens to exhaust session slots, resulting in a DoS (F4).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary unauthorized write operations on GitLab projects, potentially leading to data manipulation or destruction. By leveraging the server's live session, an attacker can access sensitive information, perform repository changes, or interact with CI/CD pipelines outside the intended scope. The unauthenticated DoS vulnerability enables service disruption with minimal request volume, effectively disabling the LLM agent integration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade @zereight/mcp-gitlab to version 2.1.30 or later to patch the identified safety control bypasses and DoS conditions.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the MCP server to authorized users or service identities, mitigating the risks posed by the unauthenticated transport and DNS rebinding vulnerabilities (F2/F3).\u003c/li\u003e\n\u003cli\u003eReview and harden GitLab project-level permissions to ensure that the token used by the MCP server follows the principle of least privilege, limiting the blast radius of any successful GraphQL injection (F1).\u003c/li\u003e\n\u003cli\u003eConfigure the MCP service to use a strictly defined SSE_AUTH_TOKEN and disable remote access unless explicitly required and secured by robust reverse-proxy authentication (F3).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T01:05:13Z","date_published":"2026-09-16T01:05:13Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-bypass/","summary":"Multiple vulnerabilities in the @zereight/mcp-gitlab package allow attackers to bypass read-only mode, exfiltrate data, perform unauthorized GitLab operations, and trigger a denial-of-service via unauthenticated session exhaustion.","title":"Multiple Safety-Control Bypasses in @zereight/mcp-gitlab","url":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Zereight/Mcp-Gitlab (\u003c 2.1.30)","version":"https://jsonfeed.org/version/1.1"}