AgentArmorHQ
Sign in
Secrets and tokens

Reject empty bearer tokens and replace placeholders on HTTP MCP servers

AgentArmorHQ team2 min read

You will upgrade @zereight/mcp-gitlab, turn off dynamic API URL support, and make your HTTP MCP servers reject empty bearer tokens and placeholder secrets. This reduces risk of a web page reaching your GitLab Private-Token.

  1. Check versionUpgrade @zereight/mcp-gitlab to 2.1.30 or later
  2. Disable dynamic URLRemove ENABLE_DYNAMIC_API_URL=true from configs
  3. Limit reachabilityKeep the HTTP transport off public interfaces
  4. Reject empty tokensReturn an error for missing or empty bearer values
  5. Rotate if exposedReplace and revoke the Private-Token

Why it matters

With ENABLE_DYNAMIC_API_URL=true, @zereight/mcp-gitlab used the X-GitLab-API-URL request header as its base URL with no allowlist and sent the victim's Private-Token along with it (GHSA-2h44-8472-frjj (opens external site)). Its Streamable HTTP endpoint also lacked Host and Origin allowlists, which allowed DNS rebinding from a browser (CVE-2026-61568 (opens external site)). Both issues were patched in 2.1.27 and 2.1.30.

Steps

  1. Check the installed version of @zereight/mcp-gitlab in every project and container that runs an HTTP MCP server. Upgrade anything older than 2.1.30, the patched release named in CVE-2026-61568 (opens external site).

  2. Search your MCP configs for ENABLE_DYNAMIC_API_URL. The header-based base URL issue in GHSA-2h44-8472-frjj (opens external site) applied when this was set to true, so remove it or set it to anything other than true.

  3. Keep the HTTP transport off public interfaces unless you need remote access. The DNS rebinding path in CVE-2026-61568 (opens external site) depends on a browser reaching the server.

  4. Where your own HTTP MCP server code reads the Authorization header, reject requests with a missing or empty bearer value and return an error. This is general practice for token handling, so test it with a request that sends an empty bearer value.

  5. Replace placeholder secrets such as example or dummy tokens in your configs with real values from your secret store. A placeholder left in a config is easy to copy into another project and hard to notice.

  6. Rotate the GitLab Private-Token for any server that ran an affected version with the HTTP transport reachable, since the Private-Token was the value at risk in GHSA-2h44-8472-frjj (opens external site). Create a new token, update the MCP config, and revoke the old one.

Common mistakes

  • Upgrading the package in one project while the same MCP config is copied into another.
  • Leaving ENABLE_DYNAMIC_API_URL set to true in a shared config file.
  • Rotating the token but not revoking the old one.
  • Assuming a server cannot be reached from a browser, even though CVE-2026-61568 (opens external site) reported DNS rebinding from a browser.

Checklist

0 of 7 done

Sources

  1. GitHub Advisory Database: GHSA-2h44-8472-frjj (CVE-2026-61559)
  2. GitHub Advisory Database: GHSA-vmp7-252j-cwp7 (CVE-2026-61568)
Was this guide useful?