{"action":"Upgrade @zereight/mcp-gitlab to 2.1.27 or later.","affected":[{"fixed":"2.1.27","introduced":"0.0.1"}],"component":"@zereight/mcp-gitlab","cve_ids":["CVE-2026-61559"],"ecosystem":"npm","epss":0.00426,"exploited":false,"fixed_versions":["2.1.27"],"ghsa_id":"GHSA-2h44-8472-frjj","id":"tcs_01M5KET58T38KRKPNDHP378GKM","modified_at":"2026-09-15T21:15:06.815575919Z","published_at":"2026-09-15T20:57:28Z","references":["https://osv.dev/vulnerability/GHSA-2h44-8472-frjj","https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj","https://github.com/zereight/gitlab-mcp/pull/625","https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d","https://github.com/zereight/gitlab-mcp","https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-2h44-8472-frjj","url":"https://osv.dev/vulnerability/GHSA-2h44-8472-frjj"}],"summary":"@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"}