Which versions of mcp-gitlab are affected by CVE-2026-61462?

The mcp-gitlab MCP server contains a critical path traversal vulnerability (CVE-2026-61462, CVSS 9.2) that allows attackers to bypass job lookup scoping and access arbitrary GitLab API endpoints…. A patch is available.

How to fix or mitigate CVE-2026-61462?

Within 24 hours, identify and disconnect all zereight's mcp-gitlab instances from production until patched, and examine the past 30 days of server logs for suspicious job_id parameters containing path traversal sequences (e.g., '../'). Within 7 days, apply the vendor-released patch to all identified instances after validating compatibility in a test environment with your GitLab configuration. Within 30 days, complete the production rollout of patched mcp-gitlab servers across all deployment environments and conduct a comprehensive audit of GitLab API access logs and data modification events to confirm no unauthorized access or exfiltration occurred during the vulnerability window.

mcp-gitlab CVE-2026-61462

Q: What is the CVSS score of CVE-2026-61462?

CVE-2026-61462 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

CRITICAL

External Control of File Name or Path (CWE-73)

2026-07-13 VulnCheck

Path Traversal Gitlab Mcp Gitlab

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable, low-complexity parameter injection with no enforced auth (PR:N per vendor); scope change (S:C) because the operator PAT reaches a different security authority, yielding high confidentiality but no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 19:27 vuln.today

Analysis Generated

Jul 13, 2026 - 19:27 vuln.today

CVE Published

Jul 13, 2026 - 17:17 cve.org

CRITICAL 9.2

DescriptionCVE.org

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.

Articles & Coverage 1

News Critical API Path Traversal in GitLab MCP Server - CVE-2026-61462 Jul 13, 2026

AnalysisAI

GitLab API request redirection in zereight's mcp-gitlab (gitlab-mcp) MCP server lets attackers who control the job_id parameter escape the intended /jobs/ path prefix and reach arbitrary GitLab REST API endpoints under the operator's personal access token. Because the token is a bearer of the operator's full GitLab privileges, a crafted value such as '../../../user' resolves to /api/v4/user (or any other resource), turning a scoped job lookup into broad unauthorized data access. No public exploit was identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially triggerable and was reported by VulnCheck with a vendor fix committed.

Technical ContextAI

mcp-gitlab is a Model Context Protocol (MCP) server that exposes GitLab CI/CD operations (pipelines, jobs, artifacts, traces) as tools an AI agent can call. It builds GitLab REST API URLs by directly interpolating caller-supplied identifiers - job_id, pipeline_id - into the path, e.g. ${apiUrl}/projects/${projectId}/jobs/${jobId}/trace. The root cause is CWE-73 (External Control of File Name or Path): jobId was not URL-encoded, so slash and ../ sequences in the value were treated as real path separators by the URL parser, collapsing the path and letting the request point at an unintended endpoint. The patch (commit e2a81a0) wraps every job/pipeline identifier in a new encodeGitLabPathSegment() helper so payloads like ../../../user are percent-encoded (..%2F..%2F..%2Fuser) and remain confined to a single path segment, as verified by an added test asserting the pathname never becomes /api/v4/user. The affected package per CPE is cpe:2.3:a:zereight:mcp-gitlab.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from commit e2a81a0 (https://github.com/zereight/gitlab-mcp/commit/e2a81a047ab8750fa5bfa1763b5d85e5616f3994), which routes all job and pipeline identifiers through encodeGitLabPathSegment() so traversal payloads stay within a single URL segment; upgrade to the corresponding released version once tagged and confirm against the VulnCheck advisory (https://www.vulncheck.com/advisories/mcp-gitlab-path-traversal-via-job-id-parameter). Until patched, reduce blast radius by scoping the GitLab personal access token used by the server to the minimum required scopes and a single project rather than an admin/broad token (trade-off: some tools that enumerate across projects will lose functionality), restricting which callers/agents may invoke the pipeline and job tools, and validating or rejecting job_id/pipeline_id values that contain '/', '..', or URL-encoded separators before they reach the server (trade-off: may block legitimately unusual identifiers). Monitor GitLab audit logs for the token making unexpected API calls such as /user or cross-project requests.