@zereight/mcp-gitlab Multiple Safety Control Bypasses

@zereight/mcp-gitlab contains five defects that defeat its safety controls for exposing GitLab to LLM agents, including read-only mode bypasses, unauthenticated transports, DNS rebinding vulnerabilities, session exhaustion DoS, and SSRF via header injection.

Disclosed 15 September 2026 · Record updated 15 September 2026

Impact

Attackers can bypass read-only protections, execute unauthorized GraphQL mutations, conduct DNS rebinding attacks, exhaust sessions via DoS, steal GitLab credentials via SSRF, and exfiltrate sensitive CI job data through prompt injection surfaces.

Our coverage

A fortress wall crumbles as a single misplaced stone tumbles free, spilling open the vault beneath while guards stand frozen, unable to close the breach.

Vulnerabilities

GitLab MCP server's read-only mode falls to a stray comma

Three GitHub advisories published on 15 September 2026 describe seven ways to defeat the safety controls in @zereight/mcp-gitlab, including credential theft with no patch available.

15 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-5648-rgj9-v224
github.comhttps://github.com/advisories/GHSA-vmp7-252j-cwp7
github.comhttps://github.com/advisories/GHSA-2h44-8472-frjj