Authentication Bypass in Model Context Protocol Server for GitLab
CVE-2026-61560
9.8CRITICAL
What is CVE-2026-61560?
The Model Context Protocol server for GitLab, prior to version 2.1.27, has a significant vulnerability where the SSE transport mode (SSE=true) allows unauthorized access to all MCP tools. Specifically, the 'upload_markdown' tool can read arbitrary files from the server’s filesystem due to an unsanitized file_path input. This presents substantial risks, as attackers can exploit this flaw to access environment variables, including the critical GITLAB_PERSONAL_ACCESS_TOKEN, enabling them to take over GitLab accounts. This vulnerability is present in default Docker configurations before the release of version 2.1.27, which includes a fix.
Affected Version(s)
gitlab-mcp < 2.1.27