AIKIDO-2026-351126

@zereight/mcp-gitlab is vulnerable to Exposure of Sensitive Information

Exposure of Sensitive Information Pre-CVE Published 4 days ago

Medium Risk

This Affects:

@zereight/mcp-gitlab

2.0.18 - 2.1.28

Fixed in 2.1.29

Are you affected? Scan for Free

TL;DR

The get_project and update_project tools return the raw GitLab project payload to MCP clients instead of filtering it through a response schema. The raw payload includes the project runners_token, a live CI runner registration credential, and import_url, which can embed credentials, so these secrets are placed into tool results and the model conversation context on routine project reads. Any consumer of that output, including AI context, transcripts, and logs, can observe the exposed credentials. The fix adds a redaction helper that strips runners_token and import_url from the responses before they are returned.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the get_project or update_project tools against a GitLab project whose response includes a runners_token or a credential-bearing import_url.