GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access
The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.
PoC 已收录GitLab MCP Server
CVSS9.8EPSS 2.9%