GHSA-5648-rgj9-v224

High

Advisory

Published 15 Sept 2026In the index since 19 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1; of 17,813 indexed, latest versions
Container images: 1; deployed by those charts
Fix available: 1 of 1; affected package

@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS

Carried by container images the latest versions of 1 of 17,813 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
@zereight/mcp-gitlabnpm	2.0.7	2.1.30	1

OSV records: GHSA-5648-rgj9-v224

Charts affected

1 by stars

Chart

Latest

Affected images

Radar Score

mcp-gitlabmcp-helm

0.3.4

1 of 1 See more

mcp-gitlab mcp-helm 0.3.4

1 of the 1 container images this version deploys carry GHSA-5648-rgj9-v224.

Container image	Digest	Package	Fixed in
iwakitakuma/gitlab-mcp :2.0.7	fb3e81aa6528	@zereight/mcp-gitlab@2.0.7	2.1.30

Open the chart page →

1,050

Container images carrying it

1 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
iwakitakuma/gitlab-mcp :2.0.7	fb3e81aa6528	@zereight/mcp-gitlab@2.0.7	2.1.30	1