Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read /proc/self/environ to steal the server's GITLABPERSONALACCESSTOKEN and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Details Two issues chain together: 1. No authentication on SSE transport (src/index.ts:7350-7388) When SSE=true (the intended mode for Docker deployments per docker-compose.yaml), the /sse and /messages endpoints have zero authentication middleware. Any HTTP client that can reach the port can establish a session and invoke all ~100+ tools using the server's configured PAT. Remote Authorization (REMOTEAUTHORIZATION=true) is explicitly incompatible with SSE mode (src/index.ts:1833-1839), so there is no way to add…
Recommended action: Upgrade to 2.1.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Description When the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim's Private-Token to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. The vulnerable code appears at two locations. SSE handler…
Recommended action: Upgrade to 2.1.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. This is CWE-350, Reliance on Reverse DNS Resolution for a Security-Critical Action. The affected package is @zereight/mcp-gitlab version 2.1.18 at commit 74a8c834424ff557ad8bc6f225e4dc5acf80aa13. The vulnerable transport setup is in index.ts. Express JSON parsing is installed globally before any MCP route-level Host or Origin allowlist: The Streamable HTTP transport is then created without the SDK DNS-rebinding controls: The transport constructor does not set enableDnsRebindingProtection, allowedHosts, or allowedOrigins. The server also does not add an Express middleware that rejects unexpected…
Recommended action: Upgrade to 2.1.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input (prompt injection) or a malicious client. Reviewed commit: 60adcc0de5b0e96c4c2029f7a25d2775946421d8 (package version 2.1.28). Source review only; PoCs are local/offline. - F1 (HIGH) executegraphql defeats BOTH read-only mode and GITLABALLOWEDPROJECTIDS. - F2 (HIGH, deployment-conditional) Streamable HTTP /mcp unauthenticated under cookie-jar / device-flow credentials. - F3 (MEDIUM) SSE unauthenticated by default, no Origin/Host validation (DNS rebinding). - F4 (HIGH) unauthenticated session/transport-exhaustion DoS (token check is syntactic only). - F5 (LOW) CI job trace returned verbatim (prompt-injection surface). Details F1 — index.ts:9194-9245 (case "executegraphql"), guard at :9196, detector in…
Recommended action: Upgrade to 2.1.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.