Skip to content
OpenAdvisories

Package · npm

@yoda.digital/gitlab-mcp-server

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.2
    CVE-2026-44895

    GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools

    GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE…

    yoda-digital mcp-gitlab-server @yoda.digital/gitlab-mcp-server Web / CMS npm