Executive brief
The @zereight/mcp-gitlab package is a Model Context Protocol integration that allows AI assistants to interact with GitLab. The default Docker deployment exposes an unauthenticated Server-Sent Events endpoint combined with an arbitrary file read vulnerability in the upload_markdown tool. An attacker with network access can read sensitive files from the server (including environment variables containing GitLab access tokens) and achieve complete account takeover of the GitLab instance with no credentials required.
Technical details
This vulnerability chains two flaws in @zereight/mcp-gitlab: (1) The SSE transport mode (SSE=true, default in Docker) exposes /sse and /messages endpoints with zero authentication, allowing any network-reachable client to invoke all ~100+ MCP tools using the server's configured GitLab Personal Access Token. (2) The upload_markdown tool calls fs.readFileSync() on unsanitized user-supplied file paths with no validation, enabling arbitrary file read. The tool reads files from the local filesystem and uploads them to a GitLab project. Combining these flaws, an unauthenticated attacker can read /proc/self/environ to steal the GITLAB_PERSONAL_ACCESS_TOKEN environment variable and gain full API access to GitLab. The Docker deployment amplifies the risk by running the process as root with the port bound to 0.0.0.0 by default. Patch 2.1.27 and later add path validation and authentication to the SSE transport.
Affected products
- zereight @zereight/mcp-gitlab < 2.1.27
Timeline
- 2026-06-22: disclosed: Vulnerability initially reported to GitHub
- 2026-09-16: advisory: GitHub Advisory published
- 2026-09-16: patched: Version 2.1.27 released with fix