CVE-2026-61560
1 advisory.
npm/@zereight/mcp-gitlab CVE-2026-61560: critical 9.8, EPSS 2.90%
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Action: Upgrade @zereight/mcp-gitlab to 2.1.27 or later.
npm i @zereight/mcp-gitlab@2.1.27Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.27 | - |
Fixed versions
| 2.1.27 |
Sources
- osv: GHSA-cv3r-c5h8-f4g5
- https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5
- https://nvd.nist.gov/vuln/detail/CVE-2026-61560
- https://github.com/zereight/gitlab-mcp/pull/482
- https://github.com/zereight/gitlab-mcp/pull/554
- https://github.com/zereight/gitlab-mcp/pull/622
- https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976
- https://github.com/zereight/gitlab-mcp
- https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27
CVE-2026-61560 · published · modified · JSON