NPM · SEPTEMBER 2026 · EARLY WARNING

zereight/gitlab-mcp npm Package SSRF Vulnerability: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
CVSS: 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
Affected component: zereight/gitlab-mcp (npm)
Patched version: Not yet available

GHSA-2H44-8472-FRJJ

An early warning has been issued regarding a potential Server-Side Request Forgery (SSRF) vulnerability in the zereight/gitlab-mcp npm package. This vulnerability may allow credential theft under certain conditions.

What happened

The zereight/gitlab-mcp npm package is reportedly vulnerable to Server-Side Request Forgery (SSRF) via the X-GitLab-API-URL header. This vulnerability appears to be exploitable when the environment variable ENABLE_DYNAMIC_API_URL is set to true. The vulnerability could allow an attacker to perform unauthorized requests and potentially steal credentials. The issue was first flagged on September 15, 2026, and is currently under investigation.

Affected versions of the package include those through commit 74a8c83. The vulnerability has been tracked under the ID GHSA-2H44-8472-FRJJ. There is no evidence that this vulnerability has been exploited in the wild at this time.

What to do about it

Avoid setting the ENABLE_DYNAMIC_API_URL environment variable to true.
Check your current version of zereight/gitlab-mcp against the affected versions through commit 74a8c83.
Monitor the provided sources for updates on a patched version.
Consider alternative packages or methods to mitigate risk until a fix is available.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If zereight/gitlab-mcp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using the zereight/gitlab-mcp npm package with the ENABLE_DYNAMIC_API_URL environment variable set to true and your version is through commit 74a8c83.

What should I do right now?

Immediately avoid setting the ENABLE_DYNAMIC_API_URL environment variable to true and monitor the sources for updates on a patched version.

Is there a patched version available?

No official fix has been published yet. Monitor the sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats