HighVulnerability
GHSA-5648-rgj9-v224: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
- Identifier
- GHSA-5648-rgj9-v224
- Published
- Record updated
- Affected
- @zereight/mcp-gitlab < 2.1.30
- Fixed in
- 2.1.30
- released July 5, 2026, 72 days before disclosure
Summary
The @zereight/mcp-gitlab package (reviewed at commit 60adcc0de5b0e96c4c2029f7a25d2775946421d8, version 2.1.28) has five defects that defeat its safety controls: read-only mode, the GITLAB_ALLOWED_PROJECT_IDS allow-list, and transport auth. The execute_graphql tool is the most serious, since a document prefixed with a comma can execute a mutation while being classified as read-only, and the handler bypasses the project allow-list entirely. Other defects expose the /mcp and SSE transports without authentication and allow session-exhaustion denial of service.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
- InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)