CVE-2026-61560: @zereight/mcp-gitlab unauthenticated arbitrary file read via upload_markdown

CVE-2026-61560 · Severity: critical · CVSS 9.8 · Published 2026-09-15

The @zereight/mcp-gitlab package is a Model Context Protocol integration that allows AI assistants to interact with GitLab. The default Docker deployment exposes an unauthenticated Server-Sent Events endpoint combined with an arbitrary file read vulnerability in the upload_markdown tool. An attacker with network access can read sensitive files from the server (including environment variables containing GitLab access tokens) and achieve complete account takeover of the GitLab instance with no credentials required.

Technologies: @zereight/mcp-gitlab (npm), Zereight Mcp-Gitlab. Vendors: npm, Zereight.

Quick answers

Is CVE-2026-61560 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61560 being exploited in the wild.
How severe is CVE-2026-61560?
Critical severity, with a CVSS score of 9.8, published 15 September 2026.
Which products and versions are affected?
@zereight/mcp-gitlab (npm) < 2.1.27, SEMVER:introduced=0,fixed=2.1.27; Zereight Mcp-Gitlab < 2.1.27.
Is there a fix for CVE-2026-61560?
Yes. @zereight/mcp-gitlab (npm): upgrade to 2.1.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61560 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61560?
Check whether you run @zereight/mcp-gitlab (npm) or Zereight Mcp-Gitlab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @zereight/mcp-gitlab (npm): upgrade to 2.1.27 or later
    npm install @zereight/mcp-gitlab@2.1.27

Technical details

This vulnerability chains two flaws in @zereight/mcp-gitlab: (1) The SSE transport mode (SSE=true, default in Docker) exposes /sse and /messages endpoints with zero authentication, allowing any network-reachable client to invoke all ~100+ MCP tools using the server's configured GitLab Personal Access Token. (2) The upload_markdown tool calls fs.readFileSync() on unsanitized user-supplied file paths with no validation, enabling arbitrary file read. The tool reads files from the local filesystem and uploads them to a GitLab project. Combining these flaws, an unauthenticated attacker can read /proc/self/environ to steal the GITLAB_PERSONAL_ACCESS_TOKEN environment variable and gain full API access to GitLab. The Docker deployment amplifies the risk by running the process as root with the port bound to 0.0.0.0 by default. Patch 2.1.27 and later add path validation and authentication to the SSE transport.

Affected products

  • zereight @zereight/mcp-gitlab < 2.1.27

Identifiers

  • CVE-2026-61560
  • GHSA-cv3r-c5h8-f4g5

Timeline

  • 2026-06-22: disclosed: Vulnerability initially reported to GitHub
  • 2026-09-16: advisory: GitHub Advisory published
  • 2026-09-16: patched: Version 2.1.27 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.