CVE-2026-61568: @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@zereight/mcp-gitlabto a version that resolves this vulnerability.Fixed in 2.1.30
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running @zereight/mcp-gitlab versions earlier than 2.1.30 with the Streamable HTTP MCP endpoint reachable on their local listener are exposed to browser-based DNS rebinding attempts.
What does an attacker need to exploit it?
An attacker needs to induce a victim to visit a malicious web page. The attack uses DNS rebinding so browser requests are routed to the victim's local MCP listener while retaining attacker-controlled Host and Origin headers.
Are default HTTP header checks sufficient to block the attack?
No. Affected versions do not enforce an effective Host or Origin allowlist, so the server accepts attacker-controlled headers and proceeds into MCP initialization rather than rejecting the request at the HTTP boundary.
What is the remediation?
Upgrade @zereight/mcp-gitlab to version 2.1.30, which contains the patch.