{"id":"EUVD-2026-32003","enisaUuid":"5fe4a02e-4fc7-3746-9bc1-069c2ef69c8d","description":"GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator\u0027s GITLAB_PERSONAL_ACCESS_TOKEN without any inbound credential check, then advertises itself to every cross-origin browser context via the wildcard CORS header. The httpServer.listen(port) call at line 97 also passes no host argument, so the bind defaults to 0.0.0.0 and exposes the auth-less surface on every interface. This vulnerability is fixed in 0.6.0.","datePublished":"May 26, 2026, 9:08:13 PM","dateUpdated":"May 27, 2026, 1:35:15 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf\n","aliases":"CVE-2026-44895\nGHSA-8jr5-6gvj-rfpf\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"f2c8b49b-3c50-363c-9141-16e2a552e7e9","product":{"name":"mcp-gitlab-server","vendor":{"name":"yoda-digital"}},"product_version":"\u003c 0.6.0"}],"enisaIdVendor":[{"id":"1060e7d8-a093-394b-8b6e-b7ad29b080f2","vendor":{"name":"yoda-digital"}}],"enisaIdVulnerability":[{"id":"48962400-e5d8-3782-b6fe-7e5ff1bdf7e1","vulnerability":{"id":"CVE-2026-44895","description":"GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator\u0027s GITLAB_PERSONAL_ACCESS_TOKEN without any inbound credential check, then advertises itself to every cross-origin browser context via the wildcard CORS header. The httpServer.listen(port) call at line 97 also passes no host argument, so the bind defaults to 0.0.0.0 and exposes the auth-less surface on every interface. This vulnerability is fixed in 0.6.0.","datePublished":"May 26, 2026, 9:08:13 PM","dateUpdated":"May 27, 2026, 1:35:15 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf\n","enisa_id":"EUVD-2026-32003\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 3, 2026, 7:17:56 AM","vulnerabilityProduct":[{"id":"32f1f1bd-be06-3bab-b087-b5827e370fbb","product":{"name":"mcp-gitlab-server","vendor":{"name":"yoda-digital"}},"product_version":"\u003c 0.6.0"}],"vulnerabilityVendor":[{"id":"ead44710-0d25-3799-9ce5-403f9b8ebd14","vendor":{"name":"yoda-digital"}}]}},{"id":"892abfed-f7de-3869-8633-c6bada9a1266","vulnerability":{"id":"GHSA-8jr5-6gvj-rfpf","description":"@yoda.digital/gitlab-mcp-server\u0027s SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools","datePublished":"May 9, 2026, 12:10:28 AM","dateUpdated":"Jun 8, 2026, 11:34:55 PM","baseScore":0.0,"references":"https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44895\nhttps://github.com/yoda-digital/mcp-gitlab-server\n","enisa_id":"EUVD-2026-32003\n","aliases":"CVE-2026-44895\nGHSA-8jr5-6gvj-rfpf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}