CVE-2026-54785: gemini-bridge Path Traversal Vulnerability

CVE-2026-54785 Overview

CVE-2026-54785 is a path traversal vulnerability [CWE-22] in gemini-bridge, a lightweight Model Context Protocol (MCP) server that connects AI agents to Google's Gemini AI through the official CLI. The consult_gemini_with_files function in inline mode reads any file path supplied through the files argument without restricting it to the working directory. Contents are then forwarded to the Gemini CLI and echoed back through the query response. Attackers with local access to the MCP interface can exfiltrate arbitrary files readable by the server process. Versions 1.0.0 through 1.3.0 are affected, and the issue is fixed in 1.3.1.

Critical Impact
Arbitrary local file read through an MCP tool call, with file contents also transmitted to Google via the Gemini round-trip.

Affected Products

gemini-bridge versions 1.0.0 through 1.3.0
AI agent deployments using gemini-bridge as an MCP server
Environments where gemini-bridge runs with access to sensitive local files

Discovery Timeline

2026-07-31 - CVE-2026-54785 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-54785

Vulnerability Analysis

The gemini-bridge MCP server exposes a consult_gemini_with_files tool that accepts a files argument alongside a caller-controlled query. In inline mode, the tool reads each supplied path from disk without validating that the resolved path resides within the working directory. It then embeds the file contents into the prompt forwarded to the Gemini CLI.

Because the caller also controls the query text, the response returned by Gemini can be crafted to echo the file contents back to the caller. This converts a benign-looking file attachment feature into a two-way arbitrary local file read primitive. File contents also transit to Google as part of the Gemini API call.

Root Cause

The root cause is missing path confinement on user-supplied file arguments [CWE-22]. Inline mode did not canonicalize the input path or verify that it descended from the configured working directory. Any absolute path or ../ traversal sequence was accepted and dereferenced by the server process.

Attack Vector

Exploitation requires the ability to invoke the MCP tool locally, typically through an AI agent client bound to the gemini-bridge server. The attacker supplies a target path such as /etc/passwd or a user's SSH key in the files argument and pairs it with a query that instructs Gemini to reproduce the attached content. Contents readable by the server's user context are returned in the tool response and also disclosed to Google.

text

// Patch reference: version bump confirming the fix landed in 1.3.1
// Source: https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801
[project]
name = "gemini-bridge"
-version = "1.3.0"
+version = "1.3.1"
description = "Lightweight MCP server bridging Claude Code to Google's Gemini AI via official CLI"

Source: GitHub Commit 8f3b85a

Detection Methods for CVE-2026-54785

Indicators of Compromise

MCP tool invocations of consult_gemini_with_files that reference absolute paths or paths containing ../ sequences
gemini-bridge process opening files outside the configured working directory, such as /etc/passwd, ~/.ssh/, or ~/.aws/credentials
Outbound Gemini API traffic containing unusually large prompt payloads following a tool call

Detection Strategies

Log all MCP tool calls to consult_gemini_with_files and alert when the files argument resolves outside the project working directory
Monitor process file-open telemetry for gemini-bridge reading sensitive paths such as credential stores, private keys, or system configuration files
Correlate MCP tool invocations with outbound requests to the Gemini API to identify data exfiltration patterns

Monitoring Recommendations

Enable verbose logging on the gemini-bridge server and centralize logs for review
Track the installed gemini-bridge version across developer workstations and CI runners to identify hosts still on 1.0.0 through 1.3.0
Alert on any file access by the MCP server process that touches user home directories or system credential locations

How to Mitigate CVE-2026-54785

Immediate Actions Required

Upgrade gemini-bridge to version 1.3.1 or later on every host running the MCP server
Audit recent MCP tool invocations for consult_gemini_with_files calls that referenced paths outside project directories
Rotate any credentials, API tokens, or private keys that may have been exposed to the gemini-bridge process

Patch Information

The fix is delivered in gemini-bridge1.3.1, which confines inline file attachments to the working directory. See the GitHub Release v1.3.1, the Pull Request #9, and the GitHub Security Advisory GHSA-c5px-58j2-7fqp for details.

Workarounds

Run gemini-bridge under a dedicated, unprivileged user account with filesystem access restricted to the intended project directory
Disable or remove the consult_gemini_with_files tool from MCP client configurations until upgrading is possible
Apply mandatory access controls or filesystem sandboxing (for example, bwrap, containers, or macOS sandbox-exec) to prevent the server from reading files outside the working directory

bash

# Upgrade gemini-bridge to the patched release
pip install --upgrade 'gemini-bridge>=1.3.1'

# Verify the installed version
python -c "import gemini_bridge; print(gemini_bridge.__version__)"