CVE-2026-61462 Overview
CVE-2026-61462 is a path traversal vulnerability [CWE-73] in the mcp-gitlab Model Context Protocol (MCP) server, distributed as zereight/gitlab-mcp. The flaw resides in the job_id parameter handled by build/index.js. Attackers can supply crafted values such as ../../../user to escape the intended GitLab API path prefix. This redirection allows unauthenticated remote attackers to reach arbitrary GitLab API endpoints using the operator's personal access token (PAT). The result is unauthorized access to any GitLab resource the token can reach, including private repositories, user data, and project settings.
Critical Impact
Remote attackers can hijack the operator's GitLab personal access token to query arbitrary GitLab API endpoints, exposing private source code and account data.
Affected Products
- zereight/gitlab-mcp (mcp-gitlab) MCP server
- Deployments using build/index.js prior to commit e2a81a0
- Any GitLab environment accessed through a vulnerable mcp-gitlab instance
Discovery Timeline
- 2026-07-13 - CVE-2026-61462 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-61462
Vulnerability Analysis
The mcp-gitlab server exposes GitLab tooling to Model Context Protocol clients such as AI assistants. When a client invokes a job-related tool, the server constructs a GitLab API URL by concatenating a base path with the user-supplied job_id. The server does not validate or sanitize job_id for directory traversal sequences. Supplying ../../../user collapses the intended path prefix and points the HTTP request at an unrelated GitLab endpoint. Because the outbound request still carries the operator's personal access token, GitLab authorizes the redirected call as the token owner. This converts a scoped job lookup into a broad API proxy under attacker control.
Root Cause
The root cause is improper control of a filename or path used in a downstream resource [CWE-73]. The handler in build/index.js treats job_id as trusted input and interpolates it directly into the API URL. No allowlist, numeric validation, or path normalization is applied before the request is issued.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker who can reach the MCP endpoint, or influence input passed to a downstream MCP client, submits a job_id value containing ../ sequences. The mcp-gitlab server then issues a GitLab API call to the attacker-chosen path. Impact scope extends beyond the MCP server itself to the connected GitLab instance, because the vulnerable component holds the caller's credentials.
Code-level exploitation details are not published. Refer to the VulnCheck Advisory for GitLab MCP and GitHub Issue #587 for technical context.
Detection Methods for CVE-2026-61462
Indicators of Compromise
- Outbound requests from mcp-gitlab to GitLab API paths that do not match the /projects/:id/jobs/:job_id structure.
- GitLab audit log entries showing PAT-authenticated access to /user, /users, /groups, or private project endpoints originating from the mcp-gitlab host.
- MCP tool invocations containing ../, %2e%2e%2f, or URL-encoded traversal sequences in the job_id field.
Detection Strategies
- Parse mcp-gitlab request logs for job_id values that are non-numeric or contain path separators.
- Correlate GitLab API access logs with the mcp-gitlab source IP to identify endpoints accessed outside the expected job scope.
- Alert on sudden increases in personal access token usage or expansion of accessed endpoint types from a single MCP host.
Monitoring Recommendations
- Enable GitLab audit events and forward them to a centralized logging platform for correlation with MCP telemetry.
- Instrument the mcp-gitlab process to log every outbound URL before issuing HTTP requests.
- Monitor commit e2a81a0 deployment status across all mcp-gitlab instances in the environment.
How to Mitigate CVE-2026-61462
Immediate Actions Required
- Upgrade zereight/gitlab-mcp to a version that includes the fix from GitHub Commit e2a81a0.
- Rotate any GitLab personal access tokens used by mcp-gitlab, treating prior tokens as potentially exposed.
- Restrict PAT scopes to the minimum required for job inspection, avoiding api scope where read_api suffices.
Patch Information
The maintainer addressed the traversal in commit e2a81a0 of the GitHub Repository for GitLab MCP. The fix constrains the job_id parameter so it can no longer redirect the outbound GitLab API request. Track remediation status in GitHub Issue #587.
Workarounds
- Place mcp-gitlab behind a proxy that rejects requests where job_id is not a positive integer.
- Terminate mcp-gitlab instances that cannot be updated and disable associated MCP tool registrations in client configurations.
- Segment the mcp-gitlab host so it can only reach the specific GitLab projects required by the workflow.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
