Database/AI/ML frameworks & serving
gitlab-mcp: path traversal in job_id redirects API calls to arbitrary GitLab endpoints
Impact
gitlab-mcp is an MCP server operators run next to agent and LLM tooling so that models can query GitLab CI. The job_id parameter is interpolated into the API path without validation, so a value such as ../../../user escapes the intended prefix and the request lands on any GitLab API endpoint the server chooses to reach - all of it authenticated with the operator's personal access token. Anything the model can be steered into requesting (a poisoned job log, an issue comment, a repository file it summarises) becomes a way to spend that token's full API privilege, which on a build fleet usually means read access to every project and the CI variables in them. The exposure is the token's scope, not the agent's intended scope.
Who can reach it
Anyone who can influence the job_id value reaching the MCP server - in practice a prompt-injection path through content the agent reads, or any caller able to invoke the tool. The server authenticates to GitLab with its own stored PAT, so no GitLab credentials are needed by the attacker.
What to do
Update gitlab-mcp to a release containing commit e2a81a0 and restart the MCP server process. Scope the personal access token it holds down to the projects it genuinely needs and rotate it if the server was reachable by untrusted input, since the traversal used that token directly. No fixed version number is stated in the record - the fix is identified by commit and issue 587.
References
Related entries
- Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
- Qdrant (snapshot recovery): Arbitrary file read and write during snapshot recoveryCVE-2024-3829 · Qdrant (snapshot recovery)Critical
- ONNX (`download_model`): Arbitrary file overwriteCVE-2024-7776 · ONNX (`download_model`)Critical
- MLflow (pyfunc tar extraction): Arbitrary file write from crafted tar entriesCVE-2025-15031 · MLflow (pyfunc tar extraction)Critical
- NVIDIA Triton (HTTP server): Attacker can start a reverse shell from the HTTP serverCVE-2025-23317 · NVIDIA Triton (HTTP server)Critical
- LangChain JS: unescaped 'lc' keys let user data be revived as a LangChain object on deserializationCVE-2025-68665 · LangChain JS (@langchain/core toJSON serialization of kwargs)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.