PT-2026-57839 · Unknown · Mcp-Gitlab

George Chen · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-61462

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mcp-gitlab versions prior to 2.1.18

Description A path traversal issue exists in the job id parameter within the build/index.js file. This allows attackers to escape the intended path prefix by providing crafted values, such as ../../../user, to redirect GitLab API requests to arbitrary endpoints. Consequently, an attacker can access unauthorized GitLab API resources using the operator's personal access token.

Recommendations Update to version 2.1.18.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-61462

Affected Products

Mcp-Gitlab

References · 6

• 🔥 https://github.com/zereight/gitlab-mcp/issues/587 · Exploit
• https://github.com/zereight/gitlab-mcp/commit/e2a81a047ab8750fa5bfa1763b5d85e5616f3994 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-61462 · Security Note
• https://github.com/zereight/gitlab-mcp · Note
• https://vulncheck.com/advisories/mcp-gitlab-path-traversal-via-job-id-parameter · Note
• https://twitter.com/f1tym1/status/2076815101143719995 · Twitter Post