GHSA-5648-rgj9-v224: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input (prompt injection) or a malicious client.
Reviewed commit: 60adcc0de5b0e96c4c2029f7a25d2775946421d8 (package version 2.1.28). Source review only; PoCs are local/offline.
- F1 (HIGH) execute_graphql defeats BOTH read-only mode and GITLAB_ALLOWED_PROJECT_IDS.
- F2 (HIGH, deployment-conditional) Streamable HTTP /mcp unauthenticated under cookie-jar / device-flow credentials.
- F3 (MEDIUM) SSE unauthenticated by default, no Origin/Host validation (DNS rebinding).
- F4 (HIGH) unauthenticated session/transport-exhaustion DoS (token check is syntactic only).
- F5 (LOW) CI job trace returned verbatim (prompt-injection surface).
References
- github.com/advisories/GHSA-5648-rgj9-v224
- github.com/zereight/gitlab-mcp/commit/69e784da33e96e64867b511c6f14d3f21f91ba8b
- github.com/zereight/gitlab-mcp/issues/596
- github.com/zereight/gitlab-mcp/issues/748
- github.com/zereight/gitlab-mcp/pull/571
- github.com/zereight/gitlab-mcp/pull/624
- github.com/zereight/gitlab-mcp/releases/tag/v2.1.30
- github.com/zereight/gitlab-mcp/security/advisories/GHSA-5648-rgj9-v224
Code Behaviors & Features
Detect and mitigate GHSA-5648-rgj9-v224 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →