Description

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-15T21:16:41.570Z",
  "pubdate": "2026-09-15T21:16:41.570Z",
  "executiveSummary": "The @zereight/mcp-gitlab Model Context Protocol (MCP) server is susceptible to a DNS rebinding vulnerability arising from improper origin and host validation within its Streamable HTTP MCP endpoint.\nThis vulnerability allows an attacker to bypass browser-based security boundaries (such as Same-Origin Policy) by tricking a victim's web browser into interacting with the local MCP server through a malicious website.\nBy manipulating DNS resolution, an attacker can route requests to the local machine while providing an attacker-controlled Host or Origin header that the server fails to adequately sanitize or reject.\nThe lack of an effective allowlist permits unauthorized requests to reach the MCP initialization path, potentially leading to unauthorized access to the user's GitLab integration data and local context.\nThis issue affects all versions prior to 2.1.30. Exploitation requires a user to navigate to a malicious web page while the vulnerable MCP server is running locally.\nThe risk is categorized as high for users relying on local LLM or IDE tools integrated with GitLab via this server, as it bypasses standard network-level security controls enforced by browsers.",
  "technicalDetails": "The vulnerability originates from the insufficient validation of HTTP 'Host' and 'Origin' headers within the Streamable HTTP MCP endpoint of the @zereight/mcp-gitlab server. Because the server processes incoming HTTP requests locally, it is inherently exposed to web-based attacks if the browser environment can be coerced into communicating with it.\nThe root cause is a deficiency in the request verification logic, which fails to enforce strict allowlist-based filtering on incoming request headers. This failure enables the server to process initialization paths for the MCP connection even when the request originates from a context that should be considered untrusted.\nThe exploitation process utilizes DNS rebinding, a technique where an attacker serves a malicious webpage that forces the victim's browser to resolve a domain name controlled by the attacker. Initially, the DNS query returns a legitimate IP address for the attacker's server to bypass initial browser checks. Shortly thereafter, the attacker updates the DNS record to point to the loopback address (127.0.0.1) or the local network IP where the @zereight/mcp-gitlab service is hosted.\nOnce the DNS entry has been updated, subsequent requests initiated by the malicious webpage are directed to the victim's local MCP server. Because the server does not enforce a robust Host or Origin allowlist, it accepts these requests as valid, allowing the malicious page to reach the MCP initialization handler.\nThrough this flow, an attacker can establish an unauthorized session with the MCP server, potentially accessing, exfiltrating, or manipulating GitLab data intended only for the local user's legitimate clients (such as AI assistants or IDE plugins). This effectively bypasses the isolation intended for local services by leveraging the browser as a proxy.\nThe vulnerability is present in versions prior to 2.1.30. No authentication is required for the initial interaction, as the server treats the request as a trusted local operation, significantly lowering the bar for exploitation via social engineering or malicious ad delivery."
}