CVE-2026-61560

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.

• CWE-22

• https://github.com/zereight/gitlab-mcp/pull/482
• https://github.com/zereight/gitlab-mcp/pull/554
• https://github.com/zereight/gitlab-mcp/pull/622
• https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5
• https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6155A weakness has been identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-61554emp3r0r is a C2 designed by Linux users for Linux environmen…7.5
• CVE-2026-61555OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-61556LiquidJS is a Shopify / GitHub Pages compatible template eng…8.7
• CVE-2026-61559`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6156A security vulnerability has been detected in Totolink A7100…9.8
• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61590djust provides Phoenix LiveView-style reactive server-side r…7.4