All vulnerabilities

CVE-2026-61568 · GHSA-vmp7-252j-cwp7

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

criticalCVSS 9.6CWE-350

Vendor

zereight

Package

@zereight/mcp-gitlab npm

Affected

< 2.1.30

Fixed in

2.1.30

Disclosed

2026-09-15

Credit

Avishai Gonen

dns-rebindingmcphost-header

Published advisory