imatza-rh/mcp-zuul

v0.4.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 2mo MCP Developer Tools

✓ No known CVEs patched

This release patches 3 known CVEs

Affected surfaces

rce_ssrf

Summary

AI summary

Fixed handling of 404 responses from /status/change/ endpoint in get_change_status.

Full changelog

URL-decode log_name and path parameters before path traversal check - percent-encoded sequences (%2e%2e/%2f) can no longer bypass .. detection
Reject user-supplied regex patterns with nested quantifiers (e.g. (a+)+) before compilation to prevent ReDoS thread consumption
CI: ignore CVE-2026-4539 (pygments ReDoS, CVSS 3.3 Low, transitive dev dep) with staleness guard that forces re-evaluation on update

get_build_failures and diagnose_build now surface ref_url, project, change, and files_in_failure (repo-relative file paths extracted from failure output) to help cross-reference failing files against the change's file list

get_change_status handles 404 from /status/change/ endpoint (some Zuul instances return 404 instead of [] for changes not in pipeline) - previously killed the call before fallback logic could run
SSL certificate errors detected at startup with actionable suggestion (ZUUL_VERIFY_SSL=false) instead of raw tracebacks
Kerberos setup: added Linux prerequisites, CLI setup form, GUI client PATH note, and troubleshooting section to README
isinstance type guard for refs elements in fmt_status_item and get_change_status - prevents AttributeError on non-dict refs from Zuul API
Removed spurious KeyError from _fetch_job_output exception list

Full Changelog: https://github.com/imatza-rh/mcp-zuul/compare/v0.4.0...v0.4.1

URL-decode `log_name` and `path` before path traversal check to prevent bypass with percent-encoded sequences
Reject user-supplied regex patterns with nested quantifiers (e.g., `(a+)+`) before compilation to prevent ReDoS
dep: Ignore CVE-2026-4539 (pygments ReDoS, CVSS 3.3 Low) – transitive dev dependency

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track imatza-rh/mcp-zuul

Get notified when new releases ship.

About imatza-rh/mcp-zuul

Zuul CI integration with 14 tools for build failure analysis, log search, pipeline status, and job configuration.