CVE-2026-61559: @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

When the environment variable ENABLE_DYNAMIC_API_URL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim’s Private-Token to every outbound fetch that uses the redirected URL.

Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim’s token to that host.

The vulnerable code appears at two locations.

SSE handler (index.ts:11541):

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check
}

Streamable HTTP handler (index.ts:11787), inside parseAuthHeaders:

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
new URL(dynamicApiUrl);                          // syntax-only check
apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted
}

In both cases, apiUrl propagates through getEffectiveApiUrl() and into getFetchConfig(), which attaches Private-Token: <victim_token> to every outbound fetch. The token reaches the attacker’s host, not GitLab.