CVE-2026-61560: MCP GitLab Auth Bypass Vulnerability

CVE-2026-61560 Overview

CVE-2026-61560 is a path traversal vulnerability in @zereight/mcp-gitlab, a Model Context Protocol (MCP) server for GitLab. Versions prior to 2.1.27 expose all MCP tools without authentication when Server-Sent Events (SSE) transport mode is enabled (SSE=true). The upload_markdown tool accepts an unsanitized file_path parameter, allowing arbitrary file reads from the server filesystem. An unauthenticated network-reachable attacker can read /proc/self/environ to extract the GITLAB_PERSONAL_ACCESS_TOKEN and achieve full GitLab account takeover. This is the default configuration for Docker deployments, expanding the attack surface significantly.

Critical Impact
Unauthenticated attackers can steal GitLab personal access tokens from the MCP server's environment, resulting in complete GitLab account takeover.

Affected Products

@zereight/mcp-gitlab versions prior to 2.1.27
Docker deployments using default SSE transport configuration
Any MCP GitLab server instance with SSE=true reachable over the network

Discovery Timeline

2026-09-15 - CVE-2026-61560 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-61560

Vulnerability Analysis

The vulnerability chains two distinct flaws in @zereight/mcp-gitlab. First, enabling SSE transport mode exposes every MCP tool over the network without authentication. Second, the upload_markdown tool reads files from the server's local filesystem using a caller-supplied file_path argument without validation or sanitization. This design gives any network-reachable client the ability to invoke privileged file operations on the host.

An attacker combines both weaknesses to request /proc/self/environ, which on Linux exposes the running process environment variables. The response contains the GITLAB_PERSONAL_ACCESS_TOKEN supplied to the container. With this token, the attacker authenticates directly to the GitLab API with the victim's privileges, enabling repository theft, code injection into CI/CD pipelines, and full account compromise.

Root Cause

The underlying weakness is a path traversal flaw [CWE-22]. The upload_markdown tool passes the file_path parameter to file read operations without canonicalization, allowlist enforcement, or containment checks. Missing authentication on the SSE transport removes the last barrier that would ordinarily limit invocation to authorized callers.

Attack Vector

The attack requires only network reachability to the MCP server's SSE endpoint. No credentials, user interaction, or prior foothold are needed. Docker deployments using the default configuration are directly exposed. The attacker issues an MCP tool call to upload_markdown with file_path set to /proc/self/environ or any other readable file, receives the file contents through the upload flow, and extracts the embedded GitLab token.

No verified public exploit code is currently published. See the GitHub Security Advisory GHSA-cv3r-c5h8-f4g5 for maintainer-provided technical details.

Detection Methods for CVE-2026-61560

Indicators of Compromise

MCP tool invocations of upload_markdown with file_path values referencing /proc/, /etc/, or paths outside the intended workspace
Unexpected uploads of environment or system files to GitLab projects associated with the MCP integration
GitLab audit events showing API activity from unfamiliar IP addresses using the server's personal access token
Outbound connections to the MCP SSE endpoint from unauthorized network sources

Detection Strategies

Inspect application logs for upload_markdown calls where file_path contains traversal sequences or absolute paths to sensitive locations
Correlate GitLab access token usage against expected source IPs and deployment infrastructure
Monitor Docker container network exposure to identify SSE endpoints reachable outside the trusted boundary
Alert on any successful reads of /proc/self/environ or .env files by the MCP server process

Monitoring Recommendations

Enable verbose logging on the MCP server and forward events to a centralized analytics platform
Track GitLab audit log entries for personal access token authentication anomalies and privilege changes
Baseline outbound API call volume from the MCP service and alert on deviations that suggest token abuse

How to Mitigate CVE-2026-61560

Immediate Actions Required

Upgrade @zereight/mcp-gitlab to version 2.1.27 or later without delay
Rotate the GITLAB_PERSONAL_ACCESS_TOKEN used by any exposed MCP server instance
Audit GitLab activity logs for unauthorized API calls, repository access, or CI/CD modifications made with the compromised token
Restrict network exposure of the MCP SSE endpoint to trusted hosts only

Patch Information

Version 2.1.27 of @zereight/mcp-gitlab contains the fix. See the maintainer pull requests for change context: PR #482, PR #554, and PR #622. Refer to the GitHub Security Advisory GHSA-cv3r-c5h8-f4g5 for the full advisory.

Workarounds

Disable SSE transport mode by unsetting or setting SSE=false and use an authenticated transport instead
Bind the MCP server to localhost or place it behind an authenticating reverse proxy
Run the container as a non-privileged user with a minimal, read-restricted filesystem to limit the impact of arbitrary file reads
Scope the GitLab personal access token to the least privilege required and set a short expiration

bash

# Configuration example: disable SSE and bind to loopback
docker run --rm \
  -e SSE=false \
  -e GITLAB_PERSONAL_ACCESS_TOKEN="$TOKEN" \
  -p 127.0.0.1:3000:3000 \
  zereight/mcp-gitlab:2.1.27