CVE-2026-44895
The GitLab MCP Server prior to version 0.6.0 runs an HTTP transport with no authentication and a wildcard Access-Control-Allow-Origin: * header, exposing a stateful, mutation-capable RPC endpoint that uses the operator's GitLab personal access token. This allows unauthenticated remote attackers to interact with GitLab via the server. The vulnerability is fixed in version 0.6.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
GitLab MCP Server versions before 0.6.0
Real-world impact
An attacker could execute arbitrary GitLab actions using the victim's personal access token without needing any credentials.
Why this severity
CVSS v4 base score 9.2 (Critical) reflects network‑adjacent, low‑complexity attack with high impact on confidentiality and integrity.
What to do about it
- 011. Upgrade GitLab MCP Server to version 0.6.0 or later.
NVD description
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.