CVE-2026-61568 is a critical vulnerability in gitlab-mcp, the same popular open-source Model Context Protocol (MCP) server (over 1,900 GitHub stars) covered by CERTVU Advisory 318, which is distinct from and disclosed separately from that advisory's CVE-2026-61559. This flaw is a DNS rebinding weakness: because the local MCP listener's initialization path relies on Host/Origin header checks rather than genuine network-origin verification, a malicious webpage visited by a victim can use a DNS rebinding technique to make the victim's browser send requests that appear to carry an attacker-controlled Host and Origin, while actually being routed to the victim's local gitlab-mcp listener, letting the attacker's webpage reach the MCP initialization path without authorization.

Affected systems are any machine running a pre-patch local gitlab-mcp listener.

gitlab-mcp (zereight) / @zereight/mcp-gitlab, versions prior to 2.1.30 - (Affected)
gitlab-mcp (zereight) / @zereight/mcp-gitlab, version 2.1.30 and later - (Not affected, patched)

Any machine running an unpatched local listener is at risk the moment its user visits an attacker-controlled or compromised webpage; no privileges are required, only that the victim load the page.

This attack requires no privileges against the target but does require the victim to visit an attacker-controlled or compromised webpage.

Step 1 - Lure a Victim to a Malicious Webpage That Performs DNS Rebinding

A victim with a local gitlab-mcp listener running visits a malicious or compromised webpage. Using a DNS rebinding technique, the page causes the victim's browser to issue a request that is actually routed to the local gitlab-mcp listener, while its Host and Origin headers still appear attacker-controlled and pass the listener's insufficient origin checks.

Step 2 - Reach the MCP Initialization Path Without Authorization

Because the listener relies on Host/Origin header validation rather than genuine origin verification, the attacker's page gains unauthorized access to the MCP initialization path on the victim's machine, potentially exposing the victim's GitLab session/credentials to further abuse.

Successful exploitation may allow an attacker to gain unauthorized access to a victim's local gitlab-mcp listener and its initialization path via a DNS rebinding attack launched from a malicious webpage, and to leverage that access against the victim's active GitLab session or credentials, potentially reaching the victim's GitLab projects and CI/CD pipelines.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade every gitlab-mcp deployment to version 2.1.30 or later without delay.

2. Avoid Browsing the Open Web on Machines Running an Unpatched Local MCP Listener

   Until the upgrade is applied, avoid browsing untrusted or unfamiliar websites on any machine running a local gitlab-mcp listener.

3. Bind the Local Listener to Localhost Only, Where Configurable

   Where the gitlab-mcp server supports it, bind the local listener to localhost rather than a network-reachable interface to reduce exposure to DNS rebinding attempts.

4. Review Browser and MCP Listener Logs for Unexpected Local Requests

   Check browser and MCP listener logs for unexpected local requests reaching the MCP initialization path from a webpage.

Report any suspected compromise involving a gitlab-mcp deployment or a stolen GitLab session to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.