https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:59:50.081738+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369341 EUVD-2026-369341 2026-10-05T15:59:50.129565+00:00 EUVD-2026-369341 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61560 fkie_cve-2026-61560 2026-10-05T15:59:50.129608+00:00

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-cv3r-c5h8-f4g5 GHSA-cv3r-c5h8-f4g5 — @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full accou… 2026-10-05T15:59:50.129647+00:00

Affected: npm: @zereight/mcp-gitlab

### Summary

The SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments.

### Details

Two issues chain together:

**1. No authentication on SSE transport (`src/index.ts:7350-7388`)**

When `SSE=true` (the intended mode for Docker deployments per `docker-compose.yaml`), the `/sse` and `/messages` endpoints have zero authentication middleware. Any HTTP client that can reach the port can establish a session and invoke all ~100+ tools using the server's configured PAT.

```typescript // src/index.ts:7354 — no auth check app.get("/sse", async (_: Request, res: Response) => { const serverInstance = createServer(); const transport = new SSEServerTransport("/messages", res); await serverInstance.connect(transport); }); ```

Remote Authorization (`REMOTE_AUTHORIZATION=true`) is explicitly incompatible with SSE mode (`src/index.ts:1833-1839`), so there is no way to add per-request auth in this transport.

**2. Arbitrary file read in `upload_markdown` (`src/index.ts:5461-5503`)**

The `upload_markdown` tool calls `fs.readFileSync(filePath)` where `file…