GitLab MCP server: attacker-supplied API URL header exfiltrates the configured GitLab token

CVSS 9.6CVE-2026-61559AI/ML frameworks & servingcurated

Impact

With ENABLE_DYNAMIC_API_URL=true, the server takes the base URL for outbound GitLab API calls from the X-GitLab-API-URL request header, checks only that it parses as a URL, and then attaches the configured Private-Token to every fetch against it. Any caller who can reach the HTTP transport redirects the next API call to a host they control and receives the token. That token is usually a long-lived GitLab PAT with repository write access, so the payoff is the CI/CD path into the fleet: source, pipeline definitions, and anything the pipelines can deploy. Agent tooling like this often runs unattended on build or inference hosts with broader network reach than the person who configured it assumed.

Who can reach it

Anyone who can send HTTP requests to the MCP server's listener - low privilege, no GitLab credentials of their own needed. Only affects deployments that have opted into ENABLE_DYNAMIC_API_URL=true.

What to do

Upgrade to @zereight/mcp-gitlab 2.1.27 or later and restart the MCP server process. If you cannot upgrade immediately, unset ENABLE_DYNAMIC_API_URL, which removes the header-driven path entirely. Treat any token that was configured on an exposed instance as compromised and rotate it in GitLab.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61559 https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.