---
title: "CVE-2026-61559: @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"
url: https://erroneo.us/security/cve/CVE-2026-61559/
description: "CVE-2026-61559 (@zereight/mcp-gitlab (npm)): @zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-15
date_modified: 2026-09-17
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-61559"
kev: false
cvss: 9.6
epss: 0.00426
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-61559: @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.4% , percentile 36: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 36% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes @zereight/mcp-gitlab (npm) >= 0.0.1, < 2.1.27, fixed in 2.1.27 . Check your lockfile, including transitive dependencies.

## What it is

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim's Private-Token to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.

## Affected packages

- npm `@zereight/mcp-gitlab` >= 0.0.1, < 2.1.27 → fixed: 2.1.27

## Affected products (CVE record)

- zereight gitlab-mcp: >= 0.0.1, < 2.1.27

## Severity

- GitHub_M CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.43% probability of exploitation activity in the next 30 days; percentile 36.

## Sources

- [GitHub Advisory GHSA-2h44-8472-frjj](https://github.com/advisories/GHSA-2h44-8472-frjj)
- [CVE.org record CVE-2026-61559](https://www.cve.org/CVERecord?id=CVE-2026-61559)
- [NVD entry CVE-2026-61559](https://nvd.nist.gov/vuln/detail/CVE-2026-61559)
- [github.com](https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj)
- [github.com](https://github.com/zereight/gitlab-mcp/pull/625)
- [github.com](https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d)
- [github.com](https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27)

---
Source page: https://erroneo.us/security/cve/CVE-2026-61559/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt