@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.1.27
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The @zereight/mcp-gitlab server, a Model Context Protocol server for GitLab, is affected when its optional dynamic API URL feature is enabled. An attacker who can reach the server's HTTP interface can redirect its GitLab API requests to a host they control, causing the server to send the user's GitLab access token to that host and exposing the credential.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
Timeline
- CVE published
- Record last updated
Affected versions
- zereight gitlab-mcp
From 0.0.1 · fixed in 2.1.27
- @zereight/mcp-gitlabnpm
From 0.0.1 · fixed in 2.1.27