CVE-2026-61559 is a critical vulnerability in gitlab-mcp, a popular open-source Model Context Protocol (MCP) server (over 1,900 GitHub stars) that lets AI coding assistants manage GitLab projects, merge requests, issues, pipelines, and wikis on a user's behalf - the same general category of AI-agent connector tooling CERTVU previously judged relevant to Vanuatu in Advisory 237 (LiteLLM MCP Authentication Bypass). When the server is run with the ENABLE_DYNAMIC_API_URL configuration option set to true, it reads an attacker-controllable X-GitLab-API-URL request header without validating the hostname, and attaches the victim's own GitLab authentication token to API calls sent to that attacker-specified URL, allowing an attacker to steal a victim's GitLab token via server-side request forgery.

Affected systems are any gitlab-mcp deployment running a pre-patch version with the option below enabled.

gitlab-mcp (zereight), versions 0.0.1 through 2.1.26, when run with ENABLE_DYNAMIC_API_URL=true - (Affected)
gitlab-mcp (zereight), version 2.1.27 and later - (Not affected, patched)

Any organization that has opted into ENABLE_DYNAMIC_API_URL to support dynamic GitLab instance targeting faces critical risk given the direct token-theft impact, and should treat this as an urgent remediation item.

This attack requires only low privileges against the MCP server and no user interaction. CERTVU is not aware of confirmed active exploitation at the time of writing.

Step 1 - Send a Crafted X-GitLab-API-URL Header to a Vulnerable Server

An attacker with low-privileged access to the gitlab-mcp server sends a request containing an X-GitLab-API-URL header pointing to an attacker-controlled host; the server does not validate that hostname before using it.

Step 2 - Have the Victim's GitLab Token Attached to the Redirected Request and Captured

The server attaches the victim's own GitLab authentication token to the outbound API call it makes to the attacker-specified URL, letting the attacker capture the token and reuse it to access the victim's GitLab account and its projects.

Successful exploitation may allow an attacker to steal a victim's GitLab authentication token via a server-side request forgery redirected through the gitlab-mcp server, and use the stolen token to access, modify, or exfiltrate the victim's GitLab projects, merge requests, issues, and CI/CD pipeline configuration, as permitted by that token's scope.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade every gitlab-mcp deployment to version 2.1.27 or later without delay.

2. Disable ENABLE_DYNAMIC_API_URL Where Patching Must Be Delayed

   Where the upgrade cannot be applied immediately, turn off the ENABLE_DYNAMIC_API_URL configuration option so the server no longer honors an attacker-controlled X-GitLab-API-URL header.

3. Rotate GitLab Tokens Used by MCP Integrations

   Rotate GitLab authentication tokens used by any gitlab-mcp integration, particularly for deployments that have run with ENABLE_DYNAMIC_API_URL enabled.

4. Review gitlab-mcp Server Logs for Unexpected Outbound API Destinations

   Check gitlab-mcp server logs for outbound API calls directed to hosts other than the organization's own GitLab instance.

Report any suspected compromise involving a gitlab-mcp deployment or a stolen GitLab token to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.