CVE-2026-61560 - gitlab-mcp
A default Docker setup of zereight/gitlab-mcp lets anyone on the network read any file on the server, including the file that stores the GitLab personal access token. By…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitlabmcp #zereight #CVE #infosec

CVE-2026-61559 - gitlab-mcp
The gitlab-mcp component reads a special header and can be tricked into sending its private access token to any address the attacker chooses. This could let a malicious…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitlabmcp #zereight #npm #CVE #infosec

CVE-2026-61568 - gitlab-mcp
The zereight/mcp-gitlab component runs a local HTTP service that accepts any web page request without checking the source. An attacker can trick a browser into sending…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitlabmcp #zereight #npm #CVE #infosec