{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/zereight/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@zereight/mcp-gitlab (\u003c 2.1.30)"],"_cs_severities":["high"],"_cs_tags":["mcp","gitlab","llm-security","supply-chain"],"_cs_type":"advisory","_cs_vendors":["zereight"],"content_html":"\u003cp\u003eThe @zereight/mcp-gitlab package (version \u0026lt; 2.1.30) contains multiple high-severity security defects that defeat the tool's intended safety controls. The package is designed to expose GitLab functionality to LLM agents using read-only mode, project allow-lists, and transport authentication. A source review identified five critical flaws: a GraphQL query parser bypass that allows write operations in read-only mode and ignores project allow-lists; flawed authentication gates that allow unauthenticated access when specific flags are enabled; missing Origin/Host validation making the service susceptible to DNS rebinding; an unauthenticated session-exhaustion denial-of-service (DoS) vulnerability; and the verbatim exposure of CI job traces to LLMs. These vulnerabilities allow malicious clients or prompt-injected LLM agents to execute arbitrary write commands on GitLab, impersonate the server's session, or disrupt service availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target running a vulnerable instance of @zereight/mcp-gitlab on a local or accessible network.\u003c/li\u003e\n\u003cli\u003eThe attacker exploits missing DNS rebinding protections (F3) by hosting a malicious website that performs a DNS rebind to access the local MCP service.\u003c/li\u003e\n\u003cli\u003eThe attacker bypasses authentication (F2) due to the flawed authentication gate logic, allowing interaction with the MCP service without valid credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted GraphQL request through the \u003ccode\u003eexecute_graphql\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eThe attacker prepends a comma to the GraphQL document (e.g., \u003ccode\u003e,mutation{...}\u003c/code\u003e) to bypass the flawed \u003ccode\u003egraphqlQueryContainsWriteOperation\u003c/code\u003e check (F1).\u003c/li\u003e\n\u003cli\u003eThe service executes the mutation against the connected GitLab instance, ignoring intended read-only and project-scope restrictions.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats unauthorized \u003ccode\u003einitialize\u003c/code\u003e requests with garbage tokens to exhaust session slots, resulting in a DoS (F4).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary unauthorized write operations on GitLab projects, potentially leading to data manipulation or destruction. By leveraging the server's live session, an attacker can access sensitive information, perform repository changes, or interact with CI/CD pipelines outside the intended scope. The unauthenticated DoS vulnerability enables service disruption with minimal request volume, effectively disabling the LLM agent integration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade @zereight/mcp-gitlab to version 2.1.30 or later to patch the identified safety control bypasses and DoS conditions.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the MCP server to authorized users or service identities, mitigating the risks posed by the unauthenticated transport and DNS rebinding vulnerabilities (F2/F3).\u003c/li\u003e\n\u003cli\u003eReview and harden GitLab project-level permissions to ensure that the token used by the MCP server follows the principle of least privilege, limiting the blast radius of any successful GraphQL injection (F1).\u003c/li\u003e\n\u003cli\u003eConfigure the MCP service to use a strictly defined SSE_AUTH_TOKEN and disable remote access unless explicitly required and secured by robust reverse-proxy authentication (F3).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T01:05:13Z","date_published":"2026-09-16T01:05:13Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-bypass/","summary":"Multiple vulnerabilities in the @zereight/mcp-gitlab package allow attackers to bypass read-only mode, exfiltrate data, perform unauthorized GitLab operations, and trigger a denial-of-service via unauthenticated session exhaustion.","title":"Multiple Safety-Control Bypasses in @zereight/mcp-gitlab","url":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zereight:mcp-gitlab:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-61559"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-gitlab (\u003e= 0.0.1, \u003c= 2.1.27)","mcp-gitlab (\u003c 2.1.30)","mcp-gitlab (\u003c 2.1.27)"],"_cs_severities":["critical"],"_cs_tags":["dns-rebinding","mcp","gitlab","cve-2026-61568","vulnerability","rce","exfiltration"],"_cs_type":"advisory","_cs_vendors":["zereight"],"content_html":"\u003cp\u003eThe npm package @zereight/mcp-gitlab contains a critical SSRF vulnerability (CVE-2026-61559) in all versions through commit 74a8c83. When the configuration variable \u003ccode\u003eENABLE_DYNAMIC_API_URL\u003c/code\u003e is set to \u003ccode\u003etrue\u003c/code\u003e, the application blindly trusts the \u003ccode\u003eX-GitLab-API-URL\u003c/code\u003e HTTP header provided by a requester. The server validates that the header is a well-formed URL but fails to perform any allowlist check or hostname restriction against the destination.\u003c/p\u003e\n\u003cp\u003eAs a result, an attacker can supply an arbitrary URL via this header. The server subsequently uses this URL for downstream GitLab API calls, attaching the victim's \u003ccode\u003ePrivate-Token\u003c/code\u003e header to the request before sending it to the attacker-controlled server. This flaw allows attackers to steal credentials and gain full authenticated access to the victim's GitLab account, including CI/CD variables, source code, and project management data. The vulnerability is reachable in multi-user deployment scenarios where \u003ccode\u003eREMOTE_AUTHORIZATION=true\u003c/code\u003e is enabled.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe target is running \u003ccode\u003emcp-gitlab\u003c/code\u003e with \u003ccode\u003eENABLE_DYNAMIC_API_URL=true\u003c/code\u003e and \u003ccode\u003eREMOTE_AUTHORIZATION=true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker initializes a listener on an external server capable of capturing HTTP headers.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious request to the MCP server's tool execution endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker injects the \u003ccode\u003eX-GitLab-API-URL\u003c/code\u003e header pointing to their listener URL.\u003c/li\u003e\n\u003cli\u003eThe MCP server process parses the malicious header and updates the API base URL for the current session.\u003c/li\u003e\n\u003cli\u003eThe server initiates a legitimate GitLab API call (e.g., to list issues) using the attacker-supplied URL.\u003c/li\u003e\n\u003cli\u003eThe server attaches the victim's \u003ccode\u003ePrivate-Token\u003c/code\u003e to the request, facilitating the SSRF-based exfiltration.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the victim's token via their listener and proceeds to exfiltrate or manipulate GitLab resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account compromise at the victim's permission level. Attackers can gain unauthorized access to all repositories, issues, and merge requests, as well as read and modify CI/CD pipelines, secrets, and environment variables. This represents a complete breach of the GitLab security domain for the affected user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIf using \u003ccode\u003emcp-gitlab\u003c/code\u003e in a multi-user environment, disable \u003ccode\u003eENABLE_DYNAMIC_API_URL\u003c/code\u003e immediately until a patched version is available.\u003c/li\u003e\n\u003cli\u003eImplement an allowlist for the \u003ccode\u003eX-GitLab-API-URL\u003c/code\u003e header by verifying the hostname against a hardcoded list of trusted GitLab instances before the request is processed.\u003c/li\u003e\n\u003cli\u003eSearch web access logs for any incoming requests containing the \u003ccode\u003eX-GitLab-API-URL\u003c/code\u003e header to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eRotate all GitLab Personal Access Tokens and CI/CD job tokens for users who interacted with an affected instance of the MCP server.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-16T19:07:21Z","date_published":"2026-09-16T01:04:47Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-ssrf/","summary":"The mcp-gitlab server is vulnerable to Server-Side Request Forgery (SSRF) when ENABLE_DYNAMIC_API_URL is enabled, allowing attackers to force the server to forward victim GitLab tokens to an arbitrary host.","title":"SSRF Vulnerability in mcp-gitlab Enables GitLab Credential Theft","url":"https://feed.craftedsignal.io/briefs/2026-09-mcp-gitlab-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Zereight","version":"https://jsonfeed.org/version/1.1"}