CVE

CVE-2026-61560

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

gitlab-mcp

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalMisconfiguration~10 seconds

GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access

The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter. References: https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5 https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976 https://nvd.nist.gov/vuln/detail/CVE-2026-61560 Remediation: Update to @zereight/mcp-gitlab 2.1.27 or later, set SSE_AUTH_TOKEN, and bind the service to a loopback address.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: gitlab-mcp

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →