CVE-2026-44895

CVE-2026-44895 (GitLab MCP Server SSE transport) has concrete technical details in the connected documents. The MCP server’s SSE HTTP transport (USE_SSE=true) ships with no authentication and sets Access-Control-Allow-Origin: * on all responses, exposing a stateful RPC endpoint backed by the oper...