EUVD-2026-369341

fkie_cve-2026-61560

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.

GHSA-cv3r-c5h8-f4g5 — @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full accou…

Affected: npm: @zereight/mcp-gitlab

### Summary

The SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments.

### Details

Two issues chain together:

**1. No authentication on SSE transport (`src/index.ts:7350-7388`)**

When `SSE=true` (the intended mode for Docker deployments per `docker-compose.yaml`), the `/sse` and `/messages` endpoints have zero authentication middleware. Any HTTP client that can reach the port can establish a session and invoke all ~100+ tools using the server's configured PAT.

```typescript // src/index.ts:7354 — no auth check app.get("/sse", async (_: Request, res: Response) => { const serverInstance = createServer(); const transport = new SSEServerTransport("/messages", res); await serverInstance.connect(transport); }); ```

Remote Authorization (`REMOTE_AUTHORIZATION=true`) is explicitly incompatible with SSE mode (`src/index.ts:1833-1839`), so there is no way to add per-request auth in this transport.

**2. Arbitrary file read in `upload_markdown` (`src/index.ts:5461-5503`)**

The `upload_markdown` tool calls `fs.readFileSync(filePath)` where `file…

Most recent entries from all

EUVD-2026-369341

fkie_cve-2026-61560

GHSA-cv3r-c5h8-f4g5 — @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full accou…