GPU VulnDB

Database/AI/ML frameworks & serving

GitLab MCP server: DNS rebinding reaches the Streamable HTTP endpoint from a web page

CVSS 9.6CVE-2026-61568AI/ML frameworks & servingcurated

Impact

The Streamable HTTP MCP endpoint is exposed without an effective Host or Origin allowlist, so a malicious web page can use DNS rebinding to aim a victim's browser at a listener bound on their own machine or network while keeping an attacker-controlled Host and Origin. The server accepts those headers and proceeds to MCP initialization instead of rejecting at the HTTP boundary, giving the page a channel to the server's GitLab tools with the server's own credentials. This is a distinct flaw from the token-exfiltration header bug (CVE-2026-61559) and lands in a different release. It is the classic reason a localhost-only bind is not a security boundary for agent tooling running on developer or build hosts.

Who can reach it

A user with a browser visits an attacker's page; no credentials or network position on the target are needed beyond that the victim's browser can reach the MCP listener. User interaction is required.

What to do

Upgrade to @zereight/mcp-gitlab 2.1.30 or later and restart the server. Until then, put the endpoint behind a reverse proxy that enforces Host and Origin checks, or use the stdio transport instead of the Streamable HTTP one.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61568https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7https://github.com/zereight/gitlab-mcp/commit/52207c6f5c0e7a39e9235d491225edbb562a0290https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.30

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.