# GHSA-5648-rgj9-v224: @zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls.

> Attackers can bypass read-only and allow-list controls to execute arbitrary GitLab GraphQL mutations or cause denial of service via unauthenticated transports.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Sep 2026

## What is GHSA-5648-rgj9-v224?

GHSA-5648-rgj9-v224 is a vulnerability in @zereight/mcp-gitlab, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary
@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input (prompt injection) or a malicious client.

Reviewed commit: 60adcc0de5b0e96c4c2029f7a25d2775946421d8 (package version 2.1.28). Source review only; PoCs are local/offline.

- F1 (HIGH) execute_graphql defeats BOTH read-only mode and GITLAB_ALLOWED_PROJECT_IDS.
- F2 (HIGH, deployment-conditional) Streamable HTTP /mcp unauthenticated under cookie-jar / device-flow credentials.
- F3 (MEDIUM) SSE unauthenticated by default, no Origin/Host validation (DNS rebinding).
- F4 (HIGH) unauthenticated session/transport-exhaustion DoS (token check is syntactic only).
- F5 (LOW) CI job trace returned verbatim (prompt-injection surface).

### Details

F1 — index.ts:9194-9245 (case "execute_graphql"), guard at :9196, detector in utils/graphql-query.ts.
(a) Read-only bypass: graphqlQueryContainsWriteOperation() strips comments/strings then tests /(?:^|[};]\s*)(mutation|subscription)\b/. GraphQL treats commas as insignificant, and stripGraphQLCommentsAndStrings does not remove them, so a document beginning with `,mutation{...}` executes as a write but is classified read-only. (b) Allow-list bypass: the handler never calls getEffectiveProjectId() or rejectIfProjectScopedDeployment() (unlike other tools), so a raw GraphQL body reaches /api/graphql with the server token against any project the token can access, regardless of GITLAB_ALLOWED_PROJECT_IDS. execute_graphql is listed in readOnlyTools (tools/registry.ts:1288).

F2 — index.ts:1048-1052 forces REMOTE_AUTHORIZATION/GITLAB_MCP_OAUTH only when started with a PAT or job token; hasCookie (:1029) and useOAuth (:1026) are absent from the gate. Started with --cookie-path or --use-oauth, validation passes and mcpBearerAuth degrades to next() (:12903). Every /mcp caller is unauthenticated while buildAuthHeaders() attaches the server's live session upstream.

F3 — index.ts:12276 requireSseAuth is a pass-through when SSE_AUTH_TOKEN is unset (default), and the SSE transport (:12290) is created with no enableDnsRebindingProtection/allowedHosts/allowedOrigins. On the default loopback bind, a malicious web page can DNS-rebind to drive the local server with the operator's GitLab credentials.

F4 — index.ts:12387 validateToken only checks length>=20 and charset (no upstream verification); parseAuthHeaders returns AuthData for any such string; new sessions are admitted purely on capacity (:12938, MAX_SESSIONS default 1000), and the per-session rate limiter only runs when a sessionId already exists. So garbage-token initialize floods fill all session slots for SESSION_TIMEOUT_SECONDS (default 3600s) -> 503 for legitimate users.

F5 — index.ts:10898-10911 (get_pipeline_job_output) returns the CI job trace to the model verbatim. Job logs are attacker-influenceable (e.g. a fork MR pipeline), so embedded instructions become model context and, combined with F1, can escalate to writes.

### PoC (local, deterministic)

F1 detector (replicates the shipped logic, no network):
    isWrite("mutation{deleteProject(input:{id:1}){errors}}")   -> DETECTED
    isWrite(",mutation{deleteProject(input:{id:1}){errors}}")  -> BYPASS (executes as a write under read-only mode)

F2 (local GitLab + cookie file):
    STREAMABLE_HTTP=true GITLAB_AUTH_COOKIE_PATH=./cookies.txt GITLAB_API_URL=http://localhost:8080/api/v4 node build/index.js
    # starts without an auth error; from another shell with NO credentials:
    curl -s http://127.0.0.1:3002/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"poc","version":"0"}}}'

F4 (REMOTE_AUTHORIZATION mode):
    for i in $(seq 1 1000); do curl -s -o /dev/null http://127.0.0.1:3002/mcp \
      -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
      -H 'Private-Token: aaaaaaaaaaaaaaaaaaaaaaaa' \
      -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"x","version":"0"}}}'; done
    # subsequent legitimate initialize -> 503 "Maximum 1000 concurrent sessions allowed"

### Impact
A semi-trusted client or a prompt-injected agent can perform arbitrary GitLab writes while the operator believes the server is read-only, against projects outside the allow-list, up to the token's privileges (F1). Anyone able to reach the port (directly or via DNS rebinding on loopback) can use the server's GitLab credentials with no authentication (F2/F3). An unauthenticated attacker can deny service with ~1000 trivial requests (F4). Attacker-influenced CI logs can steer the agent (F5).

### Remediation
Parse execute_graphql with a real GraphQL parser and reject non-query operations; enforce project scope or disable the tool under an allow-list (F1). Extend the startup gate to (hasToken || hasJobToken || hasCookie || useOAuth) and ship a mandatory Streamable-HTTP auth token (F2). Enable SDK DNS-rebinding protection with allowedHosts/allowedOrigins and require SSE_AUTH_TOKEN by default (F3). Validate tokens upstream before allocating a session, rate-limit new-session creation per IP, lower idle timeout (F4). Frame externally-sourced content as untrusted and cap size (F5).

## Which versions are affected by GHSA-5648-rgj9-v224?

2 open source packages ship an affected version, including @zereight/mcp-gitlab.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@zereight/mcp-gitlab` | npm | All versions | 2.1.30 |
| `@zereight/mcp-gitlab` | npm | All versions | 2.1.30 |

## How do I fix GHSA-5648-rgj9-v224?

Upgrade @zereight/mcp-gitlab to 2.1.30 or later.

## Is GHSA-5648-rgj9-v224 being exploited?

There is no known exploitation of GHSA-5648-rgj9-v224 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-5648-rgj9-v224 and fix it if it is affected.

What it is: GHSA-5648-rgj9-v224 is a vulnerability in @zereight/mcp-gitlab, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-5648-rgj9-v224 in the wild and no public exploit code.

Affected packages and fixed versions:
- @zereight/mcp-gitlab (npm): affected all versions; fixed in 2.1.30
- @zereight/mcp-gitlab (npm): affected all versions; fixed in 2.1.30

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-5648-rgj9-v224/ (Markdown: https://insights.sbomify.com/GHSA-5648-rgj9-v224/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-5648-rgj9-v224

---
From sbomify Insights: https://insights.sbomify.com/GHSA-5648-rgj9-v224/
Summaries are generated and may contain mistakes; the official description above is the record.