GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access

criticalseverity

9.8CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.

Impact

Unauthenticated attackers can invoke all MCP tools exposed by the server, read arbitrary local files including /proc/self/environ, and recover the configured GITLAB_PERSONAL_ACCESS_TOKEN, leading to full GitLab account takeover.

Fix

Update to @zereight/mcp-gitlab 2.1.27 or later, set SSE_AUTH_TOKEN, and bind the service to a loopback address.

How to confirm it

Send: GET /health
Positive when: contains_all(body, "\"transport\":\"sse\"", "\"status\":\"healthy\"") and status_code == 200
Send: POST /messages?sessionId={{session}}
Positive when: contains(body, "No transport found for sessionId") and status_code == 400

Run it with nuclei: nuclei -id CVE-2026-61560 -u <target>

The full check

id: CVE-2026-61560

info:
  name: GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access
  author: ashish-cybersec
  severity: critical
  description: |
    The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.
  impact: |
    Unauthenticated attackers can invoke all MCP tools exposed by the server, read arbitrary local files including /proc/self/environ, and recover the configured GITLAB_PERSONAL_ACCESS_TOKEN, leading to full GitLab account takeover.
  remediation: |
    Update to @zereight/mcp-gitlab 2.1.27 or later, set SSE_AUTH_TOKEN, and bind the service to a loopback address.
  reference:
    - https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5
    - https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976
    - https://nvd.nist.gov/vuln/detail/CVE-2026-61560
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-61560
    epss-score: 0.02901
    epss-percentile: 0.87066
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: zereight
    product: gitlab-mcp
    shodan-query: http.html:"\"transport\":\"sse\""
  tags: cve,cve2026,mcp,gitlab,auth-bypass,exposure

variables:
  session: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /health HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains_all(body, "\"transport\":\"sse\"", "\"status\":\"healthy\"")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        POST /messages?sessionId={{session}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "No transport found for sessionId")'
          - 'status_code == 400'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from