GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-44895 · CVE overview and exploitation status

EUVD-2026-32003

GHSA-8jr5-6gvj-rfpf

cve-program · CVE-2026-44895

• https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf

euvd · EUVD-2026-32003

• https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf

nvd · CVE-2026-44895

• https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf

osv · GHSA-8jr5-6gvj-rfpf

• https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf
• https://nvd.nist.gov/vuln/detail/CVE-2026-44895
• https://github.com/yoda-digital/mcp-gitlab-server

No related changes are available here.