External risk intelligence

GitLab MCP Server Unauthenticated RPC Endpoint Exposes Sensitive Access

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-44895

The vulnerability involves an MCP server intended for local AI agent-to-tool communication. While it defaults to binding to 0.0.0.0 and lacks authentication, it is typically deployed as a local sidecar or development utility rather than an internet-facing service. Exposure is possible if misconfigured or exposed via a proxy, but public internet exposure is not the standard deployment pattern.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts GitLab's MCP Server, which facilitates communication between AI agents and GitLab. The flaw allows unauthorized access to sensitive operations due to a missing authentication layer and overly permissive cross-origin resource sharing. This could potentially expose the server and its underlying GitLab access tokens to unauthenticated users within a network or from the internet if misconfigured.

Unauthenticated access to AI agent communication.
Critical issue if internal systems are exposed.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially interact with a GitLab MCP Server from any network due to its default network binding and permissive cross-origin resource sharing policies. This exposure allows an unauthenticated attacker to directly communicate with the server's RPC endpoint, which uses a privileged access token to perform actions. The absence of an authentication layer means that any request reaching the server could be processed, potentially leading to unauthorized operations.

Accessible over the network without authentication.
RPC endpoint triggered via unauthenticated HTTP requests.
Risk of unauthorized actions using privileged token.

Live Threat

Current exploitation, exposure, and threat context

The GitLab MCP Server, when not properly secured, could expose its AI agent communication interface to unauthorized access. This interface directly interacts with GitLab through an operator's personal access token. When this server binds to all network interfaces and lacks an authentication layer, it could allow unauthorized entities to interact with the AI agent functionality.

AI agent communication interface.
Direct interaction with GitLab.
Unauthorized actions via AI agent.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the GitLab MCP Server, likely managed by platform or application teams responsible for AI integrations. The first step is to identify all instances of this server, determine their reachability and business criticality, and then locate the accountable owner for remediation planning.

Identify accountable platform or application owner.
Verify server reachability and business criticality.
Plan risk-based remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GitLab MCP Server?

The GitLab MCP Server acts as a bridge for AI agents, allowing them to interact directly with GitLab projects and repositories. It enables developers to integrate automated AI assistants into their workflows by using the Model Context Protocol (MCP) to execute tasks, query data, and perform operations on GitLab through a personal access token.

What is the security weakness in CVE-2026-44895?

This vulnerability involves missing authentication (CWE-306) and overly permissive cross-origin resource sharing (CWE-942). Essentially, the server fails to verify who is sending a request and instructs browsers to allow any website to communicate with it. Because the server uses an operator's privileged access token to perform actions, these flaws allow unauthorized entities to issue commands as if they were the authorized user.

How is this vulnerability triggered?

An attacker triggers this by sending unauthorized HTTP requests to the RPC endpoint. The server defaults to binding to all network interfaces, making it reachable by any device on the network. However, local-only usage that is strictly firewalled or restricted to a loopback interface without external routing may not trigger the bug, provided no other internal systems can reach the port.

Is my server reachable from the internet?

Halo Surface Signal indicates that while the server defaults to an insecure network configuration, it is typically used as a local sidecar or development tool rather than a public service. Internet-facing exposure is generally a result of misconfiguration or being placed behind an improperly secured proxy. You should verify if your deployment is accessible beyond the local machine.

How do I secure my GitLab MCP Server instances?

The primary step is to upgrade to version 0.6.0 or later, which resolves these structural defects. Before updating, identify all running instances of the server, evaluate whether they are reachable over your network, and determine who manages them. Once identified, apply the update to ensure the authentication layer is correctly implemented and default network bindings are restricted.

References

github.com/yoda-digital/mcp-gitlab-server/security/advisories/GH…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.