What is the CVSS score of EUVD-2026-80008?

EUVD-2026-80008 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of @zereight/mcp-gitlab are affected by EUVD-2026-80008?

The @zereight/mcp-gitlab Model Context Protocol server - the component that lets AI tooling interact with our GitLab environment - can be taken over by anyone with network access to its port in the…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-80008?

Yes, a public proof-of-concept exploit is available for EUVD-2026-80008. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate EUVD-2026-80008?

Within 24 hours, inventory every deployment of @zereight/mcp-gitlab and identify hosts running in SSE transport mode (SSE=true), which is the default for Docker deployments; either upgrade those instances to version 2.1.27 or later, or immediately remove the exposed SSE endpoint from network reachability until they can be patched. In the same window, rotate every GITLAB_PERSONAL_ACCESS_TOKEN used by these servers and review GitLab audit logs for unusual token activity, unexpected project uploads, or repository access from unfamiliar sources. Within 7 days, verify by version scan that no instance below 2.1.27 remains reachable from untrusted networks, place all MCP endpoints behind authentication plus network allow-lists or a VPN/zero-trust proxy, confirm that secrets are not stored in environment variables that can be read from /proc/self/environ, and finish rotating tokens across all affected service accounts. Within 30 days, add MCP server components to the software inventory and patch-management program with recurring scans for versions below 2.1.27, harden container defaults so SSE mode is never exposed without authentication, and reduce blast radius by reviewing GitLab project permissions and service-account scopes to least privilege.

@zereight/mcp-gitlab EUVD-2026-80008

| CVE-2026-61560 CRITICAL

Path Traversal (CWE-22)

2026-09-15 security-advisories@github.com

GHSA-cv3r-c5h8-f4g5

Docker Path Traversal Gitlab Model Context Protocol

9.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Default Docker/SSE mode is unauthenticated and network-reachable (AV:N/AC:L/PR:N/UI:N); arbitrary file read plus stolen PAT yields full GitLab account takeover (C:H/I:H/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 11:40 vuln.today

tag: Model Context Protocol added

POC Analysis Generated

Sep 15, 2026 - 23:21 vuln.today

Source Code Evidence Fetched

Sep 15, 2026 - 22:30 vuln.today

Analysis Generated

Sep 15, 2026 - 22:30 vuln.today

Patch available

Sep 15, 2026 - 22:20 EUVD

CVE Published

Sep 15, 2026 - 22:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The upload_markdown tool reads arbitrary files from the server's local filesystem via an unsanitized file_path parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read /proc/self/environ to steal the server's GITLAB_PERSONAL_ACCESS_TOKEN and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.

Articles & Coverage 2

News We need answer only title. Need generate concise article title for vendor vulnerability roundup. Format: "N New [Product] Vulnerabilities - X Critical, Y With POC". Product Docker. Total CVEs 4. Severity CRITICAL 2 HIGH 2. POC count 0. Need max 100 chars. Return only title no quotes. Need decide title. "4 New Docker Vulnerabilities - 2 Critical, 0 With POC" That matches format. Check chars: 4(1)+space1=2 New=3? Let's count: Sep 16, 2026 News We need answer with JSON only. Need synthesize. Need follow all fields. Need include risk_assessment with "olsztyn" once. Must not appear elsewhere. Need be careful with product_name 1-3 words. "gitlab-mcp" maybe product. CVE description says @zereight/mcp-gitlab. Product_name: "mcp-gitlab" or "gitl...". Need generate concise SEO-friendly article title. Format: "Critical/High [Vulnerability Type] in [Product] - [CVE-ID]". Max 100 chars Sep 16, 2026

AnalysisAI

Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows any network-reachable attacker to read arbitrary files from the server host and exfiltrate their contents into an attacker-accessible GitLab project upload, enabling theft of the server's GITLAB_PERSONAL_ACCESS_TOKEN from /proc/self/environ and resulting in full GitLab account takeover. The exposure exists in SSE transport mode (SSE=true), which the advisory states is the default configuration for Docker deployments and which serves all MCP tools without any authentication; the assessed severity is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the server to be started with SSE transport enabled (SSE=true) - which the advisory states is the default for Docker deployments - because that mode exposes all MCP tools with no authentication and makes the endpoint network-reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to @zereight/mcp-gitlab 2.1.27 or later, which is the vendor-released patch per GHSA-cv3r-c5h8-f4g5 and which removes raw local-path handling from markdownUpload in remote mode and adds authenticated, expiring download tokens; verify the fix by confirming the image or package tag resolves to 2.1.27+. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every deployment of @zereight/mcp-gitlab and identify hosts running in SSE transport mode (SSE=true), which is the default for Docker deployments; either upgrade those instances to version 2.1.27 or later, or immediately remove the exposed SSE endpoint from network reachability until they can be patched. …

Threat intelligence, references, and detailed analysis are available after sign-in.