A fourth @zereight/mcp-gitlab advisory rates 9.8: unauthenticated file read chains to full GitLab account takeover in the default Docker config

GitHub Advisory Database·high signalXBlueskyLinkedInCopy link

CVE-2026-61560, published 16 Sep 2026, chains two defects in the most-used community GitLab MCP server. In SSE transport mode — the mode the project's own docker-compose.yaml uses — the `/sse` and `/messages` endpoints carry no authentication middleware, exposing all ~100 tools; the `upload_markdown` tool then reads arbitrary local files via an unsanitized `file_path`. An attacker reads `/proc/self/environ`, lifts `GITLAB_PERSONAL_ACCESS_TOKEN`, and owns the account. Fixed in 2.1.27, and it is distinct from the SSRF, DNS-rebinding and read-only-bypass advisories published a day earlier.