CVE-2026-61568 Overview
CVE-2026-61568 affects @zereight/mcp-gitlab, a Model Context Protocol (MCP) server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can leverage Domain Name System (DNS) rebinding to route a victim's browser requests to a local MCP listener while preserving attacker-controlled headers. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains the patch. The weakness is tracked under [CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action].
Critical Impact
A malicious web page can exploit DNS rebinding to reach a victim's local MCP GitLab server, invoke tools, and access or modify GitLab resources authorized to the local session.
Affected Products
- @zereight/mcp-gitlab versions prior to 2.1.30
- Streamable HTTP MCP endpoint exposed on localhost
- GitLab MCP integrations relying on this server component
Discovery Timeline
- 2026-09-15 - CVE-2026-61568 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-61568
Vulnerability Analysis
The @zereight/mcp-gitlab server exposes a Streamable HTTP MCP endpoint intended for local, same-origin use. The HTTP boundary does not enforce an allowlist on the Host or Origin headers. A browser rendering attacker-controlled content can be coerced into issuing requests toward 127.0.0.1 after a DNS rebinding step. Those requests carry an attacker-controlled hostname in the Host header while resolving to the victim's loopback interface. Because the server does not validate that the request originates from an approved origin, it processes the MCP initialize call and subsequent tool invocations.
Root Cause
The root cause is missing origin validation at the HTTP layer. The server trusts network-level locality without verifying that the Host and Origin headers match a pinned local value such as 127.0.0.1 or localhost. This aligns with [CWE-350], reliance on untrusted DNS-derived identifiers for a security decision. Local-only bindings alone do not defend against browser-initiated cross-origin flows when DNS rebinding is possible.
Attack Vector
Exploitation requires user interaction: the victim must visit a malicious web page while the MCP server is running locally. The attacker registers a domain whose DNS record initially resolves to an attacker server, then rebinds to 127.0.0.1. Scripts on the page issue fetch calls to the rebinding hostname on the MCP port. The browser sends requests to the victim's local listener with the attacker's hostname in Host and Origin. The server accepts the flow, exposing MCP tools that can enumerate, read, or modify GitLab data reachable with the local user's credentials. See the GitHub Security Advisory GHSA-vmp7-252j-cwp7 for details.
Detection Methods for CVE-2026-61568
Indicators of Compromise
- Inbound HTTP requests to the local MCP port containing Host or Origin headers that do not match 127.0.0.1, localhost, or the configured local bind address.
- MCP initialize sessions originating from browser user agents rather than approved MCP clients.
- Unexpected GitLab API activity initiated from local MCP tool calls shortly after a user visited an untrusted web page.
Detection Strategies
- Log all Host, Origin, and User-Agent headers received by the MCP HTTP listener and alert on mismatches against an allowlist.
- Correlate DNS resolutions on developer workstations where a public domain resolves to a loopback address, a hallmark of DNS rebinding.
- Review GitLab audit logs for tool-driven actions that occur without a corresponding developer-initiated MCP client session.
Monitoring Recommendations
- Enable endpoint DNS telemetry to identify short time-to-live (TTL) records resolving to 127.0.0.0/8.
- Monitor loopback listeners on developer workstations for connections initiated by browser processes.
- Track version inventory for @zereight/mcp-gitlab and flag any host running a release earlier than 2.1.30.
How to Mitigate CVE-2026-61568
Immediate Actions Required
- Upgrade @zereight/mcp-gitlab to version 2.1.30 or later on every workstation and CI host that runs the MCP server.
- Stop the MCP server when it is not actively in use to reduce exposure to browser-borne attacks.
- Rotate any GitLab tokens configured for the MCP server if unauthorized activity is suspected.
Patch Information
The maintainer released the fix in v2.1.30. The change enforces Host and Origin validation on the Streamable HTTP endpoint. Implementation details are documented in the patch commit and the pull request discussion.
Workarounds
- Bind the MCP listener to a Unix domain socket instead of an HTTP port where the client supports it.
- Place the MCP endpoint behind a reverse proxy that enforces strict Host and Origin allowlists.
- Restrict outbound DNS resolution on workstations so that public domains cannot resolve to loopback ranges.
# Configuration example
npm install @zereight/mcp-gitlab@2.1.30
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.