9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44895

CVE-2026-44895: GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator's GITLAB_PERSONAL_ACCESS_TOKEN without any inbound credential check, then advertises itself to every cross-origin browser context via the wildcard CORS header. The httpServer.listen(port) call at line 97 also passes no host argument, so the bind defaults to 0.0.0.0 and exposes the auth-less surface on every interface. This vulnerability is fixed in 0.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44895

CVE-2026-44895:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@yoda.digital/gitlab-mcp-server	npm	< 0.6.0	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of authentication and permissive CORS policy in the HTTP transport layer of @yoda.digital/gitlab-mcp-server. The analysis of the patch identified two key functions involved in this vulnerability.

The primary vulnerable function is setupTransport in src/transport.ts. This function is directly responsible for creating the HTTP server. Before the fix, it configured the server with wildcard CORS and no authentication, exposing sensitive endpoints. The patch addresses this by adding authentication logic, session-to-token binding, and stricter CORS controls directly within the request handler created in this function.

The second function, runServer in src/index.ts, is the entry point that initiates the server. It was also implicated because it lacked the necessary startup checks to prevent the server from starting in an insecure configuration. The patch added a critical safety gate (requireSafeTransportConfig) in runServer to ensure that the server will not start if configured in a way that exposes the unauthenticated transport to the network.

An attacker could exploit this by sending requests to the /sse and /messages endpoints of a vulnerable server instance. The wildcard CORS policy would allow these requests to be made from a malicious webpage visited by a user who has the server running, giving the attacker full access to the GitLab API with the server's credentials.

Vulnerable functions

setupTransport

src/transport.ts

The `setupTransport` function in `src/transport.ts` is responsible for creating and configuring the HTTP server for SSE and streamable HTTP transports. Prior to the patch, this function initialized an HTTP server that did not perform any authentication checks and used a wildcard `Access-Control-Allow-Origin: *` header. This exposed the `/sse` and `/messages` endpoints to unauthenticated requests from any origin, allowing attackers to execute arbitrary commands on the linked GitLab instance using the server's credentials.

runServer

src/index.ts

The `runServer` function is the main entry point for starting the server. It was vulnerable because it would call `setupTransport` to start the HTTP server with a configuration that was insecure by default (binding to all interfaces without authentication). The lack of pre-configuration checks in `runServer` allowed the vulnerable transport to be activated, making it a key part of the vulnerability chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.