CVE-2026-61462 zereight CVE debrief

Who should care

Users of mcp-gitlab, security teams, and vulnerability management teams should be aware of this critical vulnerability. The vulnerability's impact on the system and its potential for exploitation make it a high-priority concern for operators and security teams. Immediate action should be taken to mitigate the vulnerability's impact and prevent potential exploitation.

Technical summary

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js. Attackers can supply crafted job_id values to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token. This vulnerability has a CVSS score of 9.2 and is considered critical. The vulnerability allows attackers to redirect GitLab API requests to arbitrary endpoints, potentially leading to unauthorized access to sensitive resources.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it has a CVSS score of 9.2 and is considered critical. Immediate action should be taken to mitigate the vulnerability's impact and prevent potential exploitation.

Recommended defensive actions

• Inventory and assess mcp-gitlab installations for exposure
• Apply patches or updates provided by the vendor
• Implement compensating controls, such as monitoring and access restrictions
• Verify and restrict access to GitLab API resources
• Review and update incident response plans to account for potential exploitation
• Conduct regular security audits to identify potential vulnerabilities
• Monitor for suspicious activity and implement additional security measures as needed

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the scope and impact of this vulnerability. Evidence is limited, and defenders should verify the vulnerability's existence and impact through additional sources. The path traversal vulnerability in the job_id parameter of build/index.js allows attackers to redirect GitLab API requests to arbitrary endpoints, potentially leading to unauthorized access to sensitive resources.

Official resources