CVE-2026-61560: @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read /proc/self/environ to steal the server's GITLABPERSONALACCESSTOKEN and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@zereight/mcp-gitlabto a version that resolves this vulnerability.Fixed in 2.1.27 - Configuration
Disable SSE transport mode (SSE=true) to avoid exposing all MCP tools without authentication prior to 2.1.27, which is the described unsafe default for Docker deployments.
@zereight/mcp-gitlab (SSE transport mode) SSE = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running versions before 2.1.27 with SSE transport enabled (SSE=true) are exposed if they are network reachable. Docker deployments use this configuration by default.
What does an attacker need to exploit this issue?
An attacker needs only network access to the unauthenticated SSE service. No GitLab credentials or prior access are required.
What is the likely impact if exploitation succeeds?
An attacker can use upload_markdown to read local server files, including /proc/self/environ, and extract the GITLAB_PERSONAL_ACCESS_TOKEN. The disclosed token can enable full takeover of the associated GitLab account.
What should be done if an immediate upgrade is not possible?
Restrict network access to the SSE service so unauthenticated attackers cannot reach it, and avoid enabling SSE=true where possible. Treat the configured GitLab personal access token as potentially exposed and rotate it.
How can I remediate the vulnerability?
Upgrade @zereight/mcp-gitlab to version 2.1.27, which contains the patch.