CVE-2026-44895 - GitHub Advisory Database

What it is

CVE-2026-44895 (GHSA-8jr5-6gvj-rfpf) affects @yoda.digital/gitlab-mcp-server (mcp-gitlab-server), reviewed at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a. The SSE transport in src/transport.ts has no inbound credential check on any code path, so an unauthenticated caller can act as the operator's GitLab PAT.

How it works

• With USE_SSE=true, every response sets Access-Control-Allow-Origin: *, with methods GET, POST and header Content-Type.
• httpServer.listen(port) at line 97 passes no host, so Node binds to 0.0.0.0.
• GET /sse returns a session endpoint. POST /messages?sessionId=<id> then proxies MCP calls to GitLab using GITLAB_PERSONAL_ACCESS_TOKEN.
• The page says the PAT never leaves the process, but every API call it can make is available to the caller.
• The page says a web page the operator visits can do this via cross-origin fetch, with no interaction beyond the visit.

Preconditions / Affected

• USE_SSE=true must be set. This is the CVSS 4.0 AT:P precondition, and the README promotes SSE as a feature.
• The attacker needs network reach to the port, or the operator's browser must run a hostile page while the server is up.
• The page names no patched version. It reports the commit above and says no prior advisories exist for the package.
• Severity: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N, about 6.3 Medium. The advisory calls it functionally High wherever SSE is on.

What to do

The page gives no upgrade path. It proposes four changes. To check exposure, reproduce against your own instance:

curl -N http://localhost:3000/sse &
# note data: /messages?sessionId=<UUID>
curl -X POST "http://localhost:3000/messages?sessionId=<UUID>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_repository","arguments":{"project_id":"target-org/private-repo"}}}'

If this returns repository data, the instance is exposed. The proposed fixes are:

1. Exit at startup if USE_SSE=true and MCP_GITLAB_AUTH_TOKEN is unset, and check Authorization: Bearer <token> on every request, returning 401 on mismatch.
2. Bind to 127.0.0.1 by default. Network exposure would need an explicit MCP_GITLAB_HOST=0.0.0.0 with a warning banner.
3. Default CORS to localhost only, and require a CORS_ORIGINS allowlist when exposure is intentional.
4. SAML/OAuth is the long-term direction, listed on the roadmap at README line 190.

Until a release includes these, the practical choices are to run stdio instead of SSE, or to keep SSE off any reachable interface.

Caveats

• The proposed request check only enforces when MCP_GITLAB_AUTH_TOKEN is set, so it depends on the startup guard in item 1.
• Items 1–3 are described as achievable in the existing codebase with no new dependencies. The page doesn't say they have shipped.