Threats tagged 'ghsa-vmp7-252j-cwp7'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.6	EPSS 0.5%	CVE-2026-61568zereight gitlab-mcp · Reliance on Reverse DNS Resolution for a Security-Critical Action Critical9.6EPSS 0.5%2026-09-15CVE Database V5CVE-2026-61568 `@zereight/mcp-gitlab` versions prior to 2.1.30 have a critical vulnerability where the Streamable HTTP MCP endpoint lacks an effective Host or Origin allowlist. This allows DNS rebinding attacks to bypass HTTP boundary checks, enabling malicious web pages to interact with a victim's local MCP listener using attacker-controlled headers. Version 2.1.30 includes a patch that addresses this issue. EPSS 0.5%Vulnerability CWE-350 #ghsa-vmp7-252j-cwp7 #npm	CVE Database V5	2026-09-15

Page 1 of 1