Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-61560: zereight/mcp-gitlab lets anyone read files and steal tokens
CVE-2026-61560 · published 27 days ago
Summary
Versions of zereight/mcp-gitlab before 2.1.27 expose a tool that can read any file on the server without logging in. An attacker could use this to grab the GitLab personal access token stored on the machine and take over a GitLab account. Update the software to version 2.1.27 or later, or disable the default configuration that enables this behavior.
What to do
- Update zereight mcp-gitlab to version 2.1.27.
- Update zereight @zereight/mcp-gitlab to version 2.1.27.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | zereight | gitlab-mcp | < 2.1.27 |
| npm | zereight | mcp-gitlab |
< 2.1.27 Fix: upgrade to 2.1.27
|
| npm | zereight | @zereight/mcp-gitlab |
< 2.1.27 Fix: upgrade to 2.1.27
|
Original advisory text
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61560... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61560
- https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a264...
- https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27
- https://github.com/advisories/GHSA-cv3r-c5h8-f4g5
- https://github.com/zereight/gitlab-mcp/pull/482
- https://github.com/zereight/gitlab-mcp/pull/554
- https://github.com/zereight/gitlab-mcp/pull/622
- https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5
- https://github.com/zereight/gitlab-mcp Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-22Path Traversal
Timeline
Published15 Sep 2026
Updated9 Oct 2026
First seen15 Sep 2026
Sources
CVE-2026-61560 · NVD
CVE-2026-61560 · MITRE
CVE-2026-61560 · OSV
GHSA-cv3r-c5h8-f4g5 · GHSA
GHSA-cv3r-c5h8-f4g5 · OSV
Track software like this
Free during beta