AIKIDO-2026-936407

TL;DR

The SSE transport exposes all MCP tools with no authentication, and the upload_markdown tool reads a file from an unvalidated file_path argument before uploading it to a GitLab project. An unauthenticated network-reachable caller can chain these to read arbitrary local files such as /proc/self/environ and exfiltrate the server's GitLab personal access token, leading to full account takeover. This is reachable in the default Docker deployment, where the process runs as root and the port is network-exposed. The fix adds an SSE authentication guard and blocks remote file_path input to upload_markdown.