DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61568: CVE-2026-61568: DNS Rebinding Vulnerability in @zereight/mcp-gitlab Streamable HTTP Transport

#security #cve #cybersecurity

CVE-2026-61568: DNS Rebinding Vulnerability in @zereight/mcp-gitlab Streamable HTTP Transport

Vulnerability ID: CVE-2026-61568
CVSS Score: 9.6
Published: 2026-09-15

A critical security vulnerability has been identified in the @zereight/mcp-gitlab implementation of the Model Context Protocol (MCP) server. Prior to version 2.1.30, the server lacks HTTP Host and Origin header validation on its Streamable HTTP transport interface (/mcp). This security omission permits remote attackers to bypass the Same-Origin Policy (SOP) via a DNS Rebinding attack. Under this vector, an attacker can route malicious API requests to the victim's local or internal MCP server, thereby gaining unauthorized control over the victim's GitLab account and resources.

TL;DR

Unauthenticated remote attackers can bypass Same-Origin Policy via DNS Rebinding to execute commands and access data through the local GitLab MCP server due to missing Host and Origin header validation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-350
  • Attack Vector: Network
  • CVSS Score: 9.6
  • EPSS Score: Not Available
  • Impact: Complete Confidentiality, Integrity, and Availability Loss
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • @zereight/mcp-gitlab
  • @zereight/mcp-gitlab: < 2.1.30 (Fixed in: 2.1.30)

Code Analysis

Commit: 52207c6

fix: guard Streamable HTTP host headers

--- a/src/index.ts
+++ b/src/index.ts
+function requireMcpHostAndOrigin(req: Request, res: Response, next: NextFunction) {
+  const host = toAllowedMcpHost(req.headers.host || "");
+  if (!host || (!isLoopbackMcpHost(host) && !MCP_DNS_REBINDING_PROTECTION.allowedHosts.includes(host))) {
+    res.status(403).json({ error: "Host header is not allowed" });
+    return;
+  }
+  next();
+}
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade @zereight/mcp-gitlab to version 2.1.30 or higher to activate default Host and Origin validation.
  • Configure environment variables MCP_SERVER_URL, MCP_ALLOWED_HOSTS, and MCP_ALLOWED_ORIGINS if deploying in non-loopback topologies.
  • Bind the application socket strictly to local loopback interfaces (127.0.0.1 or ::1) rather than wildcard interfaces (0.0.0.0).

Remediation Steps:

  1. Run 'npm install @zereight/mcp-gitlab@latest' to update the package.
  2. Verify your current environment variables and ensure any non-loopback hosts are added to MCP_ALLOWED_HOSTS.
  3. Restart the MCP server service to apply the configuration.
  4. Execute a test request with a custom Host header (e.g., Host: attacker.test) to verify that an HTTP 403 Forbidden is returned.

References

Read the full report for CVE-2026-61568 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)