The flaw lies in the SSE transport of the GitLab MCP Server, which exposes an RPC endpoint without any authentication and sends a wildcard Access‑Control‑Allow‑Origin header on every response. The server binds to 0.0.0.0 by default, making the unauthenticated surface reachable from any network interface. The endpoint internally uses the operator’s GITLAB_PERSONAL_ACCESS_TOKEN, allowing any requester to issue mutation‑capable calls that can modify the connected GitLab instance. The likely attack vector is a client that can send crafted HTTP requests to the exposed SSE endpoint, potentially via a cross‑origin browser context or by directly connecting over TCP; the infrastructure does not enforce any inbound credential checks, so the attack does not require prior authentication.

Any installation of yoda‑digital mcp‑gitlab‑server older than version 0.6.0 is affected. The vulnerability is present on all interfaces the server listens to, so any locally reachable or externally exposed host running a vulnerable instance is at risk.

With a CVSS score of 9.2 the issue is considered critical. The EPSS score is not available, but the absence of authentication combined with wildcard CORS makes exploitation straightforward for an attacker on the same network or able to forge cross‑origin requests. Although not yet listed in the CISA KEV catalog, the potential to inadvertently grant an attacker the operator’s GitLab personal access token elevates the severity, warranting top‑priority remediation.