High severity8.6NVD Advisory· Published Jul 13, 2026· Updated Jul 13, 2026

CVE-2026-61462

Description

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.

Affected products

Zereight/gitlab-mcpllm-create

Patches

Vulnerability mechanics

References

github.com/zereight/gitlab-mcp/commit/e2a81a047ab8750fa5bfa1763b5d85e5616f3994nvd
github.com/zereight/gitlab-mcp/issues/587nvd
www.vulncheck.com/advisories/mcp-gitlab-path-traversal-via-job-id-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000