AIKIDO-2025-11000
@zereight/mcp-gitlab is vulnerable to Binding to an Unrestricted IP Address
67
Medium Risk
This Affects:
@zereight/mcp-gitlabTL;DR
Affected versions of this package contain a server exposure vulnerability due to the default HOST configuration being set to 0.0.0.0, which binds the service to all network interfaces; in SSE or HTTP mode, this allows any attacker on the same local network to connect to the exposed MCP server and leverage the embedded GITLAB_TOKEN permissions, leading to unauthorized access and potential misuse of GitLab credentials from other devices on the internal corporate network.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@zereight/mcp-gitlab is vulnerable to Binding to an Unrestricted IP Address in versions 2.0.0 - 2.0.20.
How to fix this
Upgrade the @zereight/mcp-gitlab library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant