Model Context Protocol
Monthly
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows any network-reachable attacker to read arbitrary files from the server host and exfiltrate their contents into an attacker-accessible GitLab project upload, enabling theft of the server's GITLAB_PERSONAL_ACCESS_TOKEN from /proc/self/environ and resulting in full GitLab account takeover. The exposure exists in SSE transport mode (SSE=true), which the advisory states is the default configuration for Docker deployments and which serves all MCP tools without any authentication; the assessed severity is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, but the attack requires only network access to the exposed SSE port and a single call to the upload_markdown tool.
Scoped OAuth MCP tokens issued by TREK before 3.3.0 can pull complete trip summaries - trip metadata, itinerary days, accommodations, and the email addresses of trip members - through the get_trip_summary tool even when the token was never granted the trips:read scope. The issue is an authenticated (CVSS PR:L), low-severity least-privilege bypass: an MCP client holding only an unrelated capability such as weather:read receives data it was never consented to read, defeating the OAuth scope boundary for the token owner's own trips and those of their collaborators. Cross-user trip authorization still holds, so the flaw is not a path to arbitrary users' trips, and no public exploit code was identified at time of analysis; vendor fix is TREK 3.3.0.
An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows any network-reachable attacker to read arbitrary files from the server host and exfiltrate their contents into an attacker-accessible GitLab project upload, enabling theft of the server's GITLAB_PERSONAL_ACCESS_TOKEN from /proc/self/environ and resulting in full GitLab account takeover. The exposure exists in SSE transport mode (SSE=true), which the advisory states is the default configuration for Docker deployments and which serves all MCP tools without any authentication; the assessed severity is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, but the attack requires only network access to the exposed SSE port and a single call to the upload_markdown tool.
Scoped OAuth MCP tokens issued by TREK before 3.3.0 can pull complete trip summaries - trip metadata, itinerary days, accommodations, and the email addresses of trip members - through the get_trip_summary tool even when the token was never granted the trips:read scope. The issue is an authenticated (CVSS PR:L), low-severity least-privilege bypass: an MCP client holding only an unrelated capability such as weather:read receives data it was never consented to read, defeating the OAuth scope boundary for the token owner's own trips and those of their collaborators. Cross-user trip authorization still holds, so the flaw is not a path to arbitrary users' trips, and no public exploit code was identified at time of analysis; vendor fix is TREK 3.3.0.
An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.