{"action":"Upgrade @zereight/mcp-gitlab to 2.1.30 or later.","affected":[{"fixed":"2.1.30","introduced":"0"}],"component":"@zereight/mcp-gitlab","cve_ids":["CVE-2026-61568"],"ecosystem":"npm","epss":0.00532,"exploited":false,"fixed_versions":["2.1.30"],"ghsa_id":"GHSA-vmp7-252j-cwp7","id":"tcs_01M5KGCCHQ87C4NWFEXPCXZZK2","modified_at":"2026-09-15T21:00:08.493839004Z","published_at":"2026-09-15T20:54:55Z","references":["https://osv.dev/vulnerability/GHSA-vmp7-252j-cwp7","https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7","https://github.com/zereight/gitlab-mcp/pull/555","https://github.com/zereight/gitlab-mcp/commit/52207c6f5c0e7a39e9235d491225edbb562a0290","https://github.com/zereight/gitlab-mcp","https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.30"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-vmp7-252j-cwp7","url":"https://osv.dev/vulnerability/GHSA-vmp7-252j-cwp7"}],"summary":"@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport"}