@zereight/mcp-gitlab relies on read-only mode, a project allow-list, and transport authentication to protect GitLab access. Five distinct flaws defeat these controls: (F1) execute_graphql incorrectly detects write operations allowing mutations despite read-only mode and bypassing project allow-list restrictions; (F2) the /mcp HTTP endpoint is unauthenticated under certain credential configurations; (F3) server-sent events (SSE) transport lacks authentication and DNS rebinding protections; (F4) session token validation is weak, allowing unauthenticated session exhaustion DoS; (F5) CI job traces are returned verbatim, enabling prompt injection attacks. These issues were identified in version 2.1.28 and earlier, with no known exploits in the wild. The CVSS 3.1 base score is 8.1 (high severity).

An attacker or a prompt-injected agent can perform arbitrary GitLab write operations despite the server being configured as read-only and bypass project allow-list restrictions, limited only by the token's privileges. Unauthenticated attackers can access the MCP server's GitLab credentials via unauthenticated HTTP and SSE transports, potentially enabling unauthorized actions. Additionally, attackers can exhaust session capacity causing denial of service to legitimate users. CI job logs returned verbatim can be manipulated to influence the agent's behavior, potentially escalating the impact.

A patch is available for @zereight/mcp-gitlab addressing these issues in versions 2.1.30 and later. Operators should upgrade to version 2.1.30 or newer to remediate these vulnerabilities. Until patched, restrict network access to the MCP server port to trusted clients only and avoid configurations that enable unauthenticated transports. Review and apply vendor guidance for secure deployment and authentication settings.