CVE-2026-61560: Three Critical Vulnerabilities in GitLab-MCP
This text was generated using artificial intelligence (AI).For the npm package @zereight/mcp-gitlab three critical vulnerabilities were published on September 15, 2026: CVE-2026-61560, CVE-2026-61568 and CVE-2026-61559. The package provides a Model Context Protocol server for GitLab and can be operated via SSE or Streamable HTTP. The vulnerabilities CVE-2026-61560 and CVE-2026-61559 were discovered by Pluto Security and coordinated publicly disclosed.
The advisories concern unprotected MCP functions, the sharing of GitLab tokens via redirected API calls, and the lack of effective checks on Host- and Originheaders. Upgrading to Version 2.1.30 or higher resolves all three published CVEs.
CVE-2026-61560: Unauthenticated SSE transport and file access
According to the GitHub Security Advisory for CVE-2026-61560 (GHSA-cv3r-c5h8-f4g5), the vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affects versions prior to 2.1.27. This was fixed in. SSE=true all MCP tools were accessible without authentication.
Additionally, the tool upload_markdown processes an insufficiently sanitized parameter. file_path. This allowed the tool to read arbitrary local files from the server's file system and upload them to a GitLab project. The advisory mentions /proc/self/environ as a potential target path.
If there is a GITLAB_PERSONAL_ACCESS_TOKEN, an unauthenticated attacker reachable over the network can read the token. The advisory describes as a possible consequence the takeover of the associated GitLab account.
This finding is particularly relevant for Docker deployments: In this context, the SSE mode is enabled by default according to the advisory. Version 2.1.27 contains a patch for CVE-2026-61560.
CVE-2026-61559: Token leak via dynamic API targets
CVE-2026-61559 (GHSA-2h44-8472-frjj) reaches a CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and affects versions from 0.0.1 and before 2.1.27, when ENABLE_DYNAMIC_API_URL=true is set. The server takes the HTTP header X-GitLab-API-URL as the base address for GitLab API calls within the respective request.
The address is checked against a valid URL format but without a allowlist or restriction to specific hostnames. The server appends its Private-Token to outgoing API requests. A caller with access to the HTTP transport can thereby provide a controlled target address; in a subsequent GitLab API call, the token can be transferred to that address.
Version 2.1.27 contains a patch for CVE-2026-61559. Until the update is applied, the ENABLE_DYNAMIC_API_URL=true should remain disabled unless the function is needed.
CVE-2026-61568: DNS rebinding against local MCP listeners
CVE-2026-61568 (GHSA-vmp7-252j-cwp7) reaches a CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and affects versions before 2.1.30. The vulnerability lies in the Streamable HTTP transport. According to the GitHub Security Advisory, a proper allowlist was missing for Host- and Origin-header.
A malicious website can redirect browser requests to a local MCP listener of the victim in a DNS rebinding attack while retaining attacker-controlled Host- and Origin-values. The affected server accepted these headers and reached the MCP initialization path.
This attack path particularly affects locally reachable MCP services. Version 2.1.30 includes a patch for CVE-2026-61568.
Measures for affected deployments
The provided recommendations focus on patch management, access restrictions, and the protection of used GitLab tokens:
@zereight/mcp-gitlab upgrade to version 2.1.30 or higher. This version addresses all three published CVEs.
Disable or secure SSE, if an upgrade has not yet occurred.
ENABLE_DYNAMIC_API_URL=true disable, unless this configuration is absolutely necessary.
GITLAB_PERSONAL_ACCESS_TOKEN rotate, if the service was accessible without authentication.
Limit network access to trusted clients, such as through firewall rules or local binding of the service.
Prioritize checking and patching Docker deployments, as the SSE mode is enabled by default configuration there.
Operate MCP servers behind an authentication layer.
Patch verification should include technical operational parameters: active transport mode, network accessibility, set environment variables, and used GitLab tokens. The installed package version alone does not indicate whether a service is reachable via SSE or if ENABLE_DYNAMIC_API_URL=true was actively set.
Organizations in Germany and Austria that operate MCP-based CI/CD services within NIS-2-mandated processes should check whether a compromised GitLab token qualifies as a reportable security incident. According to Art. 33 GDPR, there is a 72-hour reporting obligation to the responsible supervisory authority in the event of a breach of personal data protection. For operators in Switzerland, the revised Information Security Act (ISG) applies; reportable incidents must be directed to the Federal Office for Cybersecurity (BACS).
Visibility for Exposed MCP Services
The case is relevant for External Attack Surface Management because @zereight/mcp-gitlab it can be operated as an HTTP service with SSE and Streamable-HTTP transport. Such services may be reachable under corporate domains or in associated IT environments — even if they have not been centrally inventoried.
LocateRisk can support visibility of externally reachable services, unexpected HTTP endpoints, and orphaned CI infrastructure in the EASM context. This visibility does not replace the need to check the specific package version, the active transport configuration, or the permissions of a GitLab token.
Additionally, LocateRisk's Cyber Vendor Risk Management supports the continuous monitoring of the security level of third-party vendors and early detection of security-relevant changes. With npm dependencies and operated MCP services, technical reachability and dependency risks can be viewed in separate audit paths.
Am I affected?
This affects @zereight/mcp-gitlab in the versions mentioned above; the vulnerability was fixed in 2.1.27, 2.1.30. Those who want to know whether @zereight/mcp-gitlab is even visible in their externally reachable infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
@zereight/mcp-gitlab is an npm package that provides a Model-Context-Protocol server (MCP) for GitLab. It allows interaction with GitLab projects over SSE or Streamable-HTTP transport and is used in Docker environments, where the SSE mode is enabled by default.
CVE-2026-61560 and CVE-2026-61559 affect all versions prior to 2.1.27; CVE-2026-61568 affects all versions prior to 2.1.30. Upgrading to version 2.1.30 or higher fixes all three vulnerabilities in one step. Until the update is applied, SSE and ENABLE_DYNAMIC_API_URL=true should be disabled and used GITLAB_PERSONAL_ACCESS_TOKENvalues rotated.
CVE-2026-61568 (DNS Rebinding) affects the Streamable-HTTP transport and is independent of the SSE mode. CVE-2026-61559 applies when ENABLE_DYNAMIC_API_URL=true is set. A deployment is therefore potentially vulnerable even without activated SSE if one of the other configurations is present and the respective version is not patched.
Status: September 16, 2026. This contribution serves general informational purposes and does not constitute legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we assume no responsibility for the accuracy, completeness, and timeliness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-61560
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français