Three new advisories land on the most-used community GitLab MCP server, including a five-way bypass of its read-only mode and project allow-list
GitHub published three advisories for npm @zereight/mcp-gitlab on 2026-09-15: two critical at CVSS 9.6 (CVE-2026-61559 header-based SSRF leaking the Private-Token, CVE-2026-61568 DNS rebinding into the local Streamable HTTP transport) and GHSA-5648-rgj9-v224 at CVSS 8.1, which documents five separate failures of the safety controls operators actually rely on. The 8.1 detail is the builder lesson: a GraphQL query starting with a comma (`,mutation{...}`) slips past the write-detection regex, execute_graphql never checks GITLAB_ALLOWED_PROJECT_IDS at all, --cookie-path/--use-oauth skips the auth gate while still attaching the server's live credentials upstream, ~1000 trivial requests exhaust the session pool, and CI job traces are fed to the model verbatim. The package has 200,000+ downloads and 1,800+ GitHub stars; fixes are in 2.1.27 and 2.1.30, and note that the underlying Pluto Security research dates to March-July 2026 even though the CVE assignments and this advisory batch are new.
↳ Follow the thread