Database/AI/ML frameworks & serving
gitlab-mcp: unauthenticated SSE transport plus arbitrary file read leaks the GitLab token
Impact
In SSE mode (SSE=true, the default for the Docker deployment) the server exposes every MCP tool with no authentication, and upload_markdown takes an unsanitised file_path that reads any file the process can see and pushes it to a GitLab project. Chained, an unauthenticated attacker who can reach the port reads /proc/self/environ, recovers GITLAB_PERSONAL_ACCESS_TOKEN and takes over that GitLab account - which for an agent deployment usually means write access to the repos and CI that build and deploy fleet workloads. Anything else readable by the container - mounted secrets, kubeconfigs - goes the same way.
Who can reach it
Anyone with network reach to the MCP server's SSE port. No authentication at all in the affected configuration.
What to do
Upgrade to 2.1.27 and restart the MCP server container. Treat the GitLab personal access token as compromised if the port was ever reachable beyond localhost: revoke and reissue it, and review GitLab audit events for that token. Until upgraded, bind the server to loopback or put it behind an authenticating proxy, or run it over stdio instead of SSE.
References
Related entries
- SGLang (scheduler ROUTER socket): ROUTER socket binds `0.0.0.0` by default and `pickle.loads()` incoming messagesCVE-2026-7301 · SGLang (scheduler ROUTER socket)Critical
- SGLang (custom logit processor): `dill.loads` on user objects when `--enable-custom-logit-processor` is setCVE-2026-7304 · SGLang (custom logit processor)Critical
- MLflow (mlflow server / mlflow ui, Model Registry): REMOTE FILE ACCESS on the host running the tracking and registryNCVD-2023-010-mlflow-mlflow-server-mlflow-ui-m · MLflow (mlflow server / mlflow ui, Model Registry)Critical
- ClearML API server: CSRF against the API serverCVE-2024-24593 · ClearML API serverCritical
- llama-cpp-python: RCE via Jinja2 template in a GGUF model's metadata (`Llama` class)CVE-2024-34359 · llama-cpp-pythonCritical
- Jupyter Server Proxy: Unauthenticated web access to a user's proxied processesCVE-2024-35225 · Jupyter Server ProxyCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.