CVE-2026-92874 Overview
CVE-2026-92874 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE). The issue allows an authenticated user holding a Model Context Protocol (MCP)-scoped token to perform actions beyond the token's intended scope. GitLab tracks the weakness as improper authorization [CWE-863].
The vulnerability affects GitLab CE/EE versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. GitLab remediated the issue in the 19.4.1 patch release. No public exploit or in-the-wild exploitation has been reported.
Critical Impact
An authenticated user with an MCP-scoped token can bypass intended authorization boundaries and perform actions outside the token's scope, leading to limited confidentiality and integrity impact on affected GitLab instances.
Affected Products
- GitLab CE/EE versions 18.3 through 19.2.6
- GitLab CE/EE versions 19.3 through 19.3.2
- GitLab CE/EE version 19.4.0
Discovery Timeline
- 2026-09-24 - CVE-2026-92874 published to the National Vulnerability Database (NVD)
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-92874
Vulnerability Analysis
The flaw resides in GitLab's handling of Model Context Protocol (MCP)-scoped access tokens. MCP tokens are intended to restrict a client to a narrow set of operations when interacting with GitLab resources. GitLab's authorization layer failed to consistently enforce those scope restrictions on specific endpoints.
As a result, an authenticated user whose token was issued with an MCP scope could invoke actions reserved for broader token scopes. The impact is bounded by the privileges of the underlying authenticated identity, not an escalation beyond that user's account. GitLab describes the behavior as conditional, indicating particular request paths or resource types trigger the missing check.
The vulnerability does not require user interaction and is reachable over the network. Attackers must first obtain a valid authenticated session or MCP-scoped token.
Root Cause
The root cause is an improper authorization check [CWE-863] in the code paths that validate MCP token scope against the requested action. Instead of rejecting out-of-scope requests, the server processed them using the user's broader permissions.
Attack Vector
Exploitation requires an attacker to possess, or trick a legitimate user into generating, an MCP-scoped token. The attacker then issues GitLab API requests that fall outside the token's advertised scope. Because the authorization layer does not reject these requests, the server executes them. No specific exploit code has been published. See the GitLab Work Item #618614 for additional technical context.
Detection Methods for CVE-2026-92874
Indicators of Compromise
- API requests from MCP-scoped tokens targeting endpoints outside the documented MCP surface area.
- Unusual write or configuration-change operations attributed to tokens that normally issue only read or MCP-specific calls.
- Audit log entries showing a single MCP token performing a wide variety of resource types in a short window.
Detection Strategies
- Inventory active personal and project access tokens and tag those with MCP scope for enhanced monitoring.
- Correlate token identifiers in GitLab audit logs against the actions performed to flag scope mismatches.
- Alert when an MCP-scoped token authenticates to API routes that are not part of the MCP integration contract.
Monitoring Recommendations
- Forward GitLab audit events and API access logs to a centralized log platform for retention and query.
- Baseline normal MCP token behavior by endpoint and request method, then alert on deviations.
- Review self-managed GitLab instance versions on a scheduled cadence to confirm patch compliance.
How to Mitigate CVE-2026-92874
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE to version 19.4.1, 19.3.3, or 19.2.7 depending on the deployed major release.
- Rotate any MCP-scoped tokens issued prior to patching to invalidate tokens that may have been misused.
- Audit recent API activity performed by MCP-scoped tokens for actions outside their intended scope.
Patch Information
GitLab released fixes in versions 19.4.1, 19.3.3, and 19.2.7. Refer to the GitLab Patch Release 19.4.1 advisory for upgrade instructions and the full list of remediated issues. GitLab.com SaaS tenants are patched automatically.
Workarounds
- Revoke MCP-scoped tokens until the GitLab instance is upgraded to a fixed version.
- Restrict issuance of MCP-scoped tokens to a limited set of trusted service accounts and users.
- Place GitLab API endpoints behind a reverse proxy or WAF that enforces allowlists for MCP integration paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.