CVE-2026-61560

@zereight/mcp-gitlab, a Model Context Protocol (MCP) server for GitLab, in all versions prior to 2.1.27 exposes every MCP tool without authentication when run in SSE transport mode (SSE=true), which is the default for Docker deployments. An unauthenticated attacker who can reach the server over the network can invoke the upload_markdown tool, whose unsanitized file_path parameter permits path traversal (CWE-22) to read arbitrary files from the server's local filesystem, which are then uploaded to an attacker-visible GitLab project. By reading /proc/self/environ, the attacker can steal the server's GITLAB_PERSONAL_ACCESS_TOKEN and achieve full takeover of the associated GitLab account. Anyone running the package below 2.1.27 in SSE mode on a network-reachable host is affected, with a critical CVSS 3.1 score of 9.8. No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so exploitation status is currently none known.

What to do: Upgrade to @zereight/mcp-gitlab version 2.1.27 or later immediately. If the SSE port was ever reachable by untrusted hosts (check Docker port bindings and firewall rules for 0.0.0.0 exposure), treat the GITLAB_PERSONAL_ACCESS_TOKEN as compromised: revoke and rotate it, review GitLab audit logs and personal access token usage for anomalous activity, and restrict the service to localhost or an authenticated reverse proxy going forward.