DNS Rebinding Flaw in @zereight/mcp-gitlab Exposes Local MCP Streamable HTTP Transport (CVE-2026-61568)

A newly disclosed GitHub Security Advisory (GHSA-vmp7-252j-cwp7, CVE-2026-61568, CVSS 9.6) reports a DNS rebinding vulnerability in @zereight/mcp-gitlab version 2.1.18. According to the advisory, the package's Streamable HTTP MCP transport is constructed without the SDK's DNS-rebinding protections (enableDnsRebindingProtection, allowedHosts, allowedOrigins), and no Express middleware validates the Host or Origin headers before requests reach the /mcp route. The advisory states this is tracked as CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action), and a public proof of concept is available demonstrating that a browser page can perform DNS rebinding to reach a victim's loopback-bound MCP listener while presenting attacker-controlled Host/Origin headers, which the server accepts and processes through initialize.

Why It Matters

The advisory notes that in the package's REMOTE_AUTHORIZATION=true mode, token checks currently block unauthenticated tools/list calls and GitLab API tool execution — so the confirmed PoC impact is limited to reaching the MCP initialization path without a token. However, the underlying HTTP-boundary control (Host/Origin validation) is described as entirely absent, meaning any deployment mode or client flow where a GitLab token becomes browser-suppliable, or where an authenticated session is reused, could expose GitLab tooling — including calls that return sensitive data such as CI/CD variables — to an attacker-controlled web page. This affects any organization running @zereight/mcp-gitlab with the Streamable HTTP transport enabled, which the README documents as supported for remote deployments.

What Defenders Should Do Now

• Inventory MCP server deployments (particularly GitLab MCP integrations) and confirm whether Streamable HTTP transport is enabled and reachable from browser-capable environments.
• Check whether the running version enables enableDnsRebindingProtection, allowedHosts, or allowedOrigins on the transport, or has an equivalent Host/Origin allowlist middleware in front of /mcp.
• Hunt for MCP session logs or reverse proxy access logs showing requests to local MCP ports with unexpected Host or Origin header values (e.g., non-loopback domains resolving to loopback IPs).
• As a mitigation, restrict MCP listener exposure to trusted network contexts, avoid pairing browser-facing token storage with these servers, and monitor for the vendor patch that adds SDK-level DNS-rebinding protection.

This is developing intel based on a same-day GHSA publication with a public PoC; details on official patch availability and broader exploitation are not yet confirmed. See the original advisory for full technical detail: GHSA-vmp7-252j-cwp7.