CVE-2026-44895: GitLab MCP Server Auth Bypass Vulnerability

CVE-2026-44895 Overview

The GitLab Model Context Protocol (MCP) Server exposes an authentication-less HTTP transport that lets any network-reachable client invoke GitLab operations using the operator's personal access token. Versions prior to 0.6.0 ship src/transport.ts with no inbound credential check and a wildcard Access-Control-Allow-Origin: * header on every response. The Server-Sent Events (SSE) endpoint is stateful and mutation-capable, yet relies entirely on the operator-supplied GITLAB_PERSONAL_ACCESS_TOKEN for downstream GitLab calls. The httpServer.listen(port) call at line 97 omits a host argument, defaulting the bind to 0.0.0.0 and exposing the surface on every interface. The defect is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Any cross-origin browser context or network peer can drive GitLab read and write operations under the operator's identity without supplying credentials.

Affected Products

yoda-digital/mcp-gitlab-server versions prior to 0.6.0
Deployments exposing the MCP HTTP/SSE transport on any network interface
Workstations or servers running the MCP server alongside an AI agent integration

Discovery Timeline

2026-05-26 - CVE-2026-44895 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44895

Vulnerability Analysis

The MCP server implements an HTTP transport intended to broker Model Context Protocol traffic between an AI agent and GitLab. The transport accepts JSON-RPC calls over an SSE channel and forwards them to GitLab using the operator's personal access token. The component never validates an inbound caller, so any party that can reach the listening socket inherits the token's GitLab privileges.

The wildcard CORS header compounds the exposure. Browsers honor Access-Control-Allow-Origin: * for cross-origin requests, allowing a malicious web page visited by the operator to drive requests against http://localhost:<port> and exfiltrate or mutate GitLab data. Because the listener binds to 0.0.0.0, the same endpoint is also reachable from other hosts on the local network.

Root Cause

The transport in src/transport.ts lacks any authentication middleware between the HTTP entry point and the RPC dispatcher. The wildcard CORS policy and missing host argument to httpServer.listen(port) extend the attack surface from the loopback interface to every cross-origin browser context and every network peer that can route to the host.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond the operator running the vulnerable MCP server. An attacker reaches the open SSE endpoint, issues JSON-RPC tool calls, and the server proxies them to GitLab with the operator's personal access token. Achievable actions include reading private repositories, modifying source code, manipulating merge requests, and altering project settings.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-8jr5-6gvj-rfpf for the maintainer's technical description.

Detection Methods for CVE-2026-44895

Indicators of Compromise

Inbound connections to the MCP server port from addresses other than 127.0.0.1 or ::1.
Unexpected GitLab audit log entries showing API calls authenticated with the operator's personal access token outside normal working patterns.
Browser referer or origin headers reaching the MCP endpoint from domains unrelated to the developer's tooling.
New SSH keys, deploy tokens, or webhooks added to GitLab projects without a corresponding change request.

Detection Strategies

Inventory hosts running mcp-gitlab-server and confirm the installed version is 0.6.0 or later.
Inspect process listeners for the MCP port bound to 0.0.0.0 instead of 127.0.0.1.
Correlate GitLab API audit events with developer endpoint activity to surface RPC calls that occurred while no agent session was active.

Monitoring Recommendations

Forward GitLab audit and access logs to a centralized analytics platform and alert on personal access token use from new source IPs or user agents.
Monitor host firewall logs for external connections to MCP transport ports on developer workstations.
Track creation of new GitLab tokens, project members, and CI/CD variables for changes that lack an approved ticket.

How to Mitigate CVE-2026-44895

Immediate Actions Required

Upgrade mcp-gitlab-server to version 0.6.0 or later on every host that runs it.
Rotate the GITLAB_PERSONAL_ACCESS_TOKEN configured for the MCP server and scope the new token to the minimum required permissions.
Restrict the MCP listener to 127.0.0.1 and block external access to its port at the host firewall.
Review GitLab audit logs for unauthorized activity tied to the exposed personal access token.

Patch Information

The maintainer fixed the issue in release 0.6.0. Refer to the GitHub Security Advisory GHSA-8jr5-6gvj-rfpf for the patch details and upgrade instructions.

Workarounds

Bind the MCP transport to the loopback interface only and front it with an authenticating reverse proxy if remote access is required.
Replace the wildcard CORS policy with an allowlist of trusted origins until the upgrade is applied.
Run the MCP server inside a network namespace or container with no external port mapping.

bash

# Configuration example: restrict the MCP server to loopback and a host firewall rule
export MCP_HTTP_HOST=127.0.0.1
export MCP_HTTP_PORT=8429

# Linux: block external access to the MCP port
sudo iptables -A INPUT -p tcp --dport 8429 ! -s 127.0.0.1 -j DROP