As a result, an attacker can supply an arbitrary URL via this header. The server subsequently uses this URL for downstream GitLab API calls, attaching the victim's Private-Token header to the request before sending it to the attacker-controlled server. This flaw allows attackers to steal credentials and gain full authenticated access to the victim's GitLab account, including CI/CD variables, source code, and project management data. The vulnerability is reachable in multi-user deployment scenarios where REMOTE_AUTHORIZATION=true is enabled.

Attack Chain

1. The target is running mcp-gitlab with ENABLE_DYNAMIC_API_URL=true and REMOTE_AUTHORIZATION=true.
2. The attacker initializes a listener on an external server capable of capturing HTTP headers.
3. The attacker crafts a malicious request to the MCP server's tool execution endpoint.
4. The attacker injects the X-GitLab-API-URL header pointing to their listener URL.
5. The MCP server process parses the malicious header and updates the API base URL for the current session.
6. The server initiates a legitimate GitLab API call (e.g., to list issues) using the attacker-supplied URL.
7. The server attaches the victim's Private-Token to the request, facilitating the SSRF-based exfiltration.
8. The attacker receives the victim's token via their listener and proceeds to exfiltrate or manipulate GitLab resources.

Impact

Successful exploitation results in full account compromise at the victim's permission level. Attackers can gain unauthorized access to all repositories, issues, and merge requests, as well as read and modify CI/CD pipelines, secrets, and environment variables. This represents a complete breach of the GitLab security domain for the affected user.

Recommendation

1. If using mcp-gitlab in a multi-user environment, disable ENABLE_DYNAMIC_API_URL immediately until a patched version is available.
2. Implement an allowlist for the X-GitLab-API-URL header by verifying the hostname against a hardcoded list of trusted GitLab instances before the request is processed.
3. Search web access logs for any incoming requests containing the X-GitLab-API-URL header to identify potential exploitation attempts.
4. Rotate all GitLab Personal Access Tokens and CI/CD job tokens for users who interacted with an affected instance of the MCP server.