CVE-2026-61560: @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
The SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The upload_markdown tool reads arbitrary files from the server’s local filesystem via an unsanitized file_path parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read /proc/self/environ to steal the server’s GITLAB_PERSONAL_ACCESS_TOKEN and achieve full GitLab account takeover. This is the default configuration for Docker deployments.
References
- github.com/advisories/GHSA-cv3r-c5h8-f4g5
- github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976
- github.com/zereight/gitlab-mcp/pull/482
- github.com/zereight/gitlab-mcp/pull/554
- github.com/zereight/gitlab-mcp/pull/622
- github.com/zereight/gitlab-mcp/releases/tag/v2.1.27
- github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5
- nvd.nist.gov/vuln/detail/CVE-2026-61560
Code Behaviors & Features
Detect and mitigate CVE-2026-61560 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →