All vulnerabilities

CVE-2026-NONE · GHSA-fcj2-hj27-hj26

gitlab-mcp-server: caller-controlled GITLAB-URL enables SSRF in legacy HTTP mode

highCVSS 7.2CWE-918

Vendor

jmrplens

Package

github.com/jmrplens/gitlab-mcp-server go

Affected

>= 1.1.0, <= 2.7.5 (module path github.com/jmrplens/gitlab-mcp-server/v2; neither v1 nor v2 module path received a patch)

Fixed in

3.0.0 (new module path github.com/jmrplens/gitlab-mcp-server/v3)

Disclosed

2026-09-14

Credit

Avishai Gonen

ssrfmcp

Published advisory