Capability Laundering in MCP 3: CVE-2026-27735 Anthropic Git MCP Server git_add Path Traversal to Credential Exfiltration

CVE-2026-27735: MCP Git Server git_add path traversal vulnerability enables credential exfiltration via GitPython's missing boundary validation. A single git_add call reads SSH keys, kubeconfig, and AWS credentials into Git history — invisible in the working directory. Third case of capability laundering in MCP ecosystems.