CRITICAL9.6npm
GHSA-2h44-8472-frjj· CVE-2026-61559@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Modified: 9/15/2026
package
npm/@zereight/mcp-gitlab
pkg:npm/%40zereight/mcp-gitlab
HIGH8.1npm
GHSA-5648-rgj9-v224@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
Modified: 9/15/2026
CRITICAL9.8npm
GHSA-cv3r-c5h8-f4g5· CVE-2026-61560@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Modified: 9/16/2026
CRITICAL9.6npm
GHSA-vmp7-252j-cwp7· CVE-2026-61568@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
Modified: 9/15/2026