The vulnerability arises when the Model Context Protocol server for GitLab processes the upload_markdown command in Server‑Sent Events mode without authenticating the caller. An attacker can provide any file_path value, and the command will read the requested file from the host’s filesystem and upload its contents to a GitLab project. Because the path is unsanitized, the attacker can read sensitive files such as /proc/self/environ, which contains the GITLAB_PERSONAL_ACCESS_TOKEN. With that token, the attacker can then access the GitLab instance as the user who owns the token and perform any actions the token permits. This leads to a full GitLab account takeover. The flaw is assigned CWE‑22, which denotes an arbitrary file read vulnerability. The high CVSS score of 9.8 reflects the total impact to confidentiality and integrity, as well as the ease of exploitation.

Affected systems are installations of @zereight/mcp‑gitlab older than version 2.1.27 when SSE transport mode is enabled. The default Docker configuration sets SSE=true and leaves the upload_markdown tool available without authentication, so any user who can reach the server over the network can trigger the flaw. No additional privileges or local code execution are required beyond being able to connect to the service.

The EPSS score is currently below 1 percent, suggesting that the attacker impact is not widely observed at this time, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the CVSS score of 9.8 indicates that exploitation would provide complete control over the GitLab account. The consumption path is a simple HTTP request to the SSE endpoint. Because the service is unauthenticated, the attack can be carried out remotely by any network‑reachable host, making the threat vector local network or the Internet, depending on exposure. No additional steps or specialized tooling are required to exploit the flaw.