Executive brief
zereight mcp-gitlab is a tool used to integrate GitLab functionality into Model Context Protocol (MCP) environments, allowing AI agents to interact with GitLab repositories. A security flaw allows attackers to bypass intended access restrictions by manipulating job and pipeline identifiers. This could allow an unauthorized user to access sensitive GitLab API data, such as user profiles or administrative information, by leveraging the server's own access tokens.
Technical details
A path traversal vulnerability exists in mcp-gitlab (specifically within build/index.js) due to improper sanitization of the 'job_id' and 'pipeline_id' parameters. While 'project_id' is URL-encoded, 'job_id' is interpolated raw into GitLab API request URLs. Because the 'new URL()' constructor in Node.js normalizes path segments, an attacker can provide a crafted value such as '../../../user' to escape the intended '/projects/{id}/jobs/' path prefix. This allows the attacker to reach arbitrary GitLab API v4 endpoints. Since these requests are authenticated using the operator's GITLAB_PERSONAL_ACCESS_TOKEN, the exploit can lead to unauthorized data disclosure from the GitLab instance. The issue is fixed in version 2.1.18 by ensuring path segments are properly encoded.
Affected products
- zereight mcp-gitlab (npm package) < 2.1.18
Timeline
- 2026-06-05: other: Initial report to vendor
- 2026-07-10: patched: Fix committed to repository
- 2026-07-13: disclosed: CVE published