Log in / Sign up

Vulnerability details

CVE-2026-44895

yoda-digital mcp-gitlab-server

GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools

CVSS 4.0
9.2Critical

Official description

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator's GITLAB_PERSONAL_ACCESS_TOKEN without any inbound credential check, then advertises itself to every cross-origin browser context via the wildcard CORS header. The httpServer.listen(port) call at line 97 also passes no host argument, so the bind defaults to 0.0.0.0 and exposes the auth-less surface on every interface. This vulnerability is fixed in 0.6.0.

CVSS scores

ScoreVersionSourceVector
9.2Critical 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
yoda-digital mcp-gitlab-server < 0.6.0 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-05-27
Last updated
2026-05-27
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.44%
Probability of exploitation in 30 days
38.9%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-306
    Missing Authentication for Critical Function
  • CWE-942
    Permissive Cross-domain Policy with Untrusted Domains