EUVD-2026-79999
GHSA-vmp7-252j-cwp7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryDNS rebinding retargets to local MCP listener
-
ExploitSend /mcp request with attacker Host/Origin
-
ExecutionServer accepts headers, reaches initialize path
-
PersistDrive GitLab tool calls via victim token
-
ImpactExfiltrate or modify GitLab repo data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication DNS-independent verification
|
| Exploitation Conditions | Requires ALL of: the @zereight/mcp-gitlab server (versions < 2.1.30) running with the Streamable HTTP transport enabled and a valid GitLab token configured; the server reachable at its default loopback bind (127.0.0.1) with no MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINS or effective Host/Origin allowlist (the pre-patch default); and the victim actively browsing to an attacker-controlled web page that performs DNS rebinding (UI:R). Limiting factors: exploitation needs victim user interaction, a locally running listener with a configured token, and - where REMOTE_AUTHORIZATION=true is set - token checks block material unauthenticated GitLab API tool calls, reducing impact to the HTTP-boundary/initialize failure. Not exploitable if the server is unpatched-but-fronted by an external proxy enforcing Host/Origin, or if the token has minimal scope. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) rates this Critical, but several signals temper real-world urgency. Exploitation is network-based and requires no authentication at the HTTP boundary (PR:N), yet it is fundamentally gated on user interaction (UI:R): a victim must have the MCP server running locally with a valid GitLab token AND visit an attacker-controlled web page for the DNS-rebinding attack to fire. A public proof-of-concept exists (referenced in the GHSA advisory), and a vendor patch is available in v2.1.30 - so this is a real, actionable priority for anyone running the affected package, not merely a paper-high score. However, there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation; treat this as a patchable, POC-backed defensive priority rather than an in-the-wild campaign. The advisory itself notes an important nuance conflicting with the C:H/I:H/A:H rating: when REMOTE_AUTHORIZATION=true, token checks block unauthenticated tools/list and material GitLab API calls - the confirmed defect is the HTTP/Host-Origin boundary failure reaching the MCP initialize path; full C/I/A impact against GitLab data depends on the deployment lacking token enforcement or the attacker chaining to the victim's configured token. The A:H component in particular is the weakest-supported metric. The S:C (scope change) is defensible because the local MCP server acts as a bridge to a separate security authority (the victim's GitLab instance). |
| Exploit ScenarioDerived | A developer runs @zereight/mcp-gitlab locally (default bind 127.0.0.1) with their GitLab token configured, then browses to an attacker-controlled web page. That page uses DNS rebinding to point its hostname at the victim's loopback listener while sending an attacker-controlled Host/Origin; because the server enforces no effective Host/Origin allowlist, the browser request reaches the MCP initialize path and the attacker can drive GitLab tool calls in the victim's context. A public PoC demonstrating the no-token initialize succeeding with attacker-controlled headers is referenced in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
RemediationAI
Upgrade to the vendor-released patch, @zereight/mcp-gitlab 2.1.30, which introduces Host/Origin validation for the /mcp endpoint (PR #555, commit 52207c6f5c0e7a39e9235d491225edbb562a0290, release v2.1.30; advisory GHSA-vmp7-252j-cwp7). After upgrading, set MCP_SERVER_URL to the server's public HTTPS URL and, where clients send a host that differs from it, configure MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS explicitly; note the upgrade side effect documented by the vendor - deployments reached through a non-loopback hostname or LAN IP that do not set MCP_SERVER_URL or MCP_ALLOWED_HOSTS will have /mcp requests rejected with HTTP 403, so plan the configuration change with the upgrade to avoid an outage. If immediate patching is not possible, a compensating control with a clear trade-off is to terminate the listener behind a reverse proxy or gateway that rejects /mcp requests whose Host/Origin are not on an explicit allowlist (this restores the missing boundary but requires the proxy to sit in front of every reachable path to the service and adds an operational dependency); alternatively, keep the service bound strictly to 127.0.0.1 and avoid exposing it through any local browser-reachable surface, accepting that this does not remove the DNS-rebinding vector when the victim's browser is the request source. Additional hardening that reduces blast radius rather than eliminating the defect: enable REMOTE_AUTHORIZATION=true so token checks block material unauthenticated GitLab API tool calls (the advisory notes the HTTP-boundary/initialize failure remains), and issue the configured GitLab token with the minimum scope and shortest practical lifetime so that any successful cross-origin tool invocation cannot reach sensitive projects. No vendor-released patch other than 2.1.30 is identified, and no zero-day or confirmed in-the-wild exploitation is indicated - the available signal is public proof-of-concept code only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Model Context Protocol (MCP) Streamable HTTP transport in the npm package @zereight/mcp-gitlab, an MCP server that fronts the GitLab API. The root cause is CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action): the service makes an access-control decision based on the incoming Host/Origin headers without validating them against an allowlist. Concretely, the advisory shows Express JSON parsing installed globally before any MCP route-level control (index.ts:12077, app.use(express.json())), and the StreamableHTTPServerTransport constructed at index.ts:12375 without the MCP SDK's enableDnsRebindingProtection, allowedHosts, or allowedOrigins options, with no Express middleware rejecting unexpected Host or Origin values ahead of /mcp. Because config.ts:192 defaults HOST to 127.0.0.1, the server's default posture is exactly the loopback target DNS rebinding is designed to hit: an attacker-controlled page resolves a hostname to 127.0.0.1, so the browser connects locally while sending the attacker's Host/Origin. The 2.1.30 patch adds MCP_SERVER_URL, MCP_ALLOWED_HOSTS, and MCP_ALLOWED_ORIGINS plus helper routines (toAllowedMcpHost, toAllowedMcpOrigin, isLoopbackMcpHost, isLoopbackMcpOrigin, getMcpDnsRebindingProtection) that permit loopback hosts on any port (to accommodate Docker port mapping such as -p 3333:3002) and otherwise reject unmatched requests with 403. The same commit hardens CI supply chain by pinning actions/checkout and actions/setup-node to commit SHAs and setting persist-credentials: false, which is unrelated to the vulnerability but indicates the release also carried CI hygiene changes.
Know when npm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network DNS-rebinding needs no auth at the HTTP boundary (PR:N) but requires the victim to visit a malicious page (UI:R); S:C as impact crosses to GitLab; A:L since availability impact is limited versus confidentiality/integrity of repo data.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.
Technical POC Analysis
The vulnerability is CWE-350, but the practical defect is an absent HTTP boundary check: the Streamable HTTP MCP server trusts attacker-supplied Host and Origin headers.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
@zereight/mcp-gitlab deployments running versions before 2.1.30 expose developer workstations to a browser-based attack that can silently relay GitLab API actions through a victim's own configured credentials. Exploitation requires no attacker credentials and no special infrastructure - only that a developer visits a malicious web page while an unpatched local MCP listener is running - which places source code, CI/CD pipelines, and repository permissions within reach of a single user misstep. Because the affected population is developers holding privileged GitLab tokens, leadership should treat this as a developer-endpoint and software supply-chain risk rather than an isolated library defect.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pack
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to reso
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character e
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an Ope
Exploit-DB