npm/@yoda.digital/gitlab-mcp-server CVE-2026-44895: high
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
Action: Upgrade @yoda.digital/gitlab-mcp-server to 0.6.0 or later.
npm i @yoda.digital/gitlab-mcp-server@0.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.0 | - |
Fixed versions
| 0.6.0 |
Sources
- osv: GHSA-8jr5-6gvj-rfpf
- https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf
- https://nvd.nist.gov/vuln/detail/CVE-2026-44895
- https://github.com/yoda-digital/mcp-gitlab-server
CVE-2026-44895 · published · modified · JSON