{"id":"CVE-2026-61560","title":"`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab","summary":"`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from th…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"zereight","product":"@zereight/mcp-gitlab","affected":["@zereight/mcp-gitlab < 2.1.27"],"patched":["@zereight/mcp-gitlab 2.1.27"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T14:17:06.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61560","references":[{"url":"https://github.com/zereight/gitlab-mcp/pull/482","label":"security-advisories@github.com"},{"url":"https://github.com/zereight/gitlab-mcp/pull/554","label":"security-advisories@github.com"},{"url":"https://github.com/zereight/gitlab-mcp/pull/622","label":"security-advisories@github.com"},{"url":"https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5","label":"security-advisories@github.com"},{"url":"https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61560"},{"url":"https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976"},{"url":"https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"},{"url":"https://github.com/advisories/GHSA-cv3r-c5h8-f4g5"}],"tags":["nvd","ghsa","npm","cve.org","exploit-available"],"aliases":["GHSA-cv3r-c5h8-f4g5"],"ecosystem":"npm","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-16T13:59:23.698471Z"},"epss":0.00703,"epssPercentile":0.5144,"ingestedAt":"2026-09-15T21:44:50.658Z","slug":"CVE-2026-61560","body":"## Overview\n\n`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61560)\n\nAffected packages:\n\n- `@zereight/mcp-gitlab < 2.1.27`\n\nPatched in:\n\n- `@zereight/mcp-gitlab 2.1.27`\n\nSource: https://github.com/advisories/GHSA-cv3r-c5h8-f4g5","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":204957,"id":"CVE-2026-61560","ts":1789570683150,"field":"exploit_available","old":"false","new":"true"}]}