CVE-2026-48529 (GCVE-0-2026-48529)
Vulnerability from cvelistv5 – Published: 2026-06-26 16:33 – Updated: 2026-06-27 02:43
VLAI
EPSS
VEX
Title
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
Summary
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.
Severity
6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-27 02:42 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/github/github-mcp-server/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| github | github-mcp-server |
Affected:
>= 0.22.0, < 1.1.2
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48529",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-27T02:42:44.775898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T02:43:34.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "github-mcp-server",
"vendor": "github",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.22.0, \u003c 1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:33:32.688Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"source": {
"advisory": "GHSA-pjp5-fpmr-3349",
"discovery": "UNKNOWN"
},
"title": "GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48529",
"datePublished": "2026-06-26T16:33:32.688Z",
"dateReserved": "2026-05-21T16:18:10.619Z",
"dateUpdated": "2026-06-27T02:43:34.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-48529",
"date": "2026-09-22",
"epss": "0.00205",
"percentile": "0.10867"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "github-mcp-server",
"vendor": "github",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.22.0, \u003c 1.1.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2."
}
],
"id": "CVE-2026-48529",
"lastModified": "2026-06-27T04:17:49.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48529",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-27T02:42:44.775898Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-26T17:16:33.820",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-07-30T16:44:15Z",
"cve": "CVE-2026-48529",
"id": "CVE-2026-48529",
"initial_release_date": "2026-07-30T16:44:15Z",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-48529",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-48529.json",
"version": "2"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48529",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-27T02:42:44.775898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T02:43:21.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "github-mcp-server",
"vendor": "github",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.22.0, \u003c 1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:33:32.688Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"source": {
"advisory": "GHSA-pjp5-fpmr-3349",
"discovery": "UNKNOWN"
},
"title": "GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48529",
"datePublished": "2026-06-26T16:33:32.688Z",
"dateReserved": "2026-05-21T16:18:10.619Z",
"dateUpdated": "2026-06-27T02:43:34.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-48529
Vulnerability from fkie_nvd - Published: 2026-06-26 17:16 - Updated: 2026-06-27 04:17
Severity
Summary
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "github-mcp-server",
"vendor": "github",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.22.0, \u003c 1.1.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2."
}
],
"id": "CVE-2026-48529",
"lastModified": "2026-06-27T04:17:49.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48529",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-27T02:42:44.775898Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-26T17:16:33.820",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-PJP5-FPMR-3349
Vulnerability from github – Published: 2026-06-25 21:32 – Updated: 2026-06-25 21:32
VLAI
Summary
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
Details
Summary
When running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens.
Details
The singleton is defined in pkg/lockdown/lockdown.go:
var (
instance *RepoAccessCache
instanceMu sync.Mutex
)
func GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {
instanceMu.Lock()
defer instanceMu.Unlock()
if instance == nil {
instance = &RepoAccessCache{
client: client, // only stored on first call
}
}
return instance // subsequent callers receive the same object regardless of their client
}
In HTTP mode, pkg/github/dependencies.go calls this per request:
func (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAccessCache, error) {
gqlClient, err := d.GetGQLClient(ctx) // creates client with request's token
...
instance := lockdown.GetInstance(gqlClient, d.RepoAccessOpts...)
// gqlClient is silently dropped if singleton already exists
return instance, nil
}
The singleton's internal client field is never updated after the first initialization. All lockdown GraphQL queries that check repository access and visibility (queryRepoAccessInfo, called by IsSafeContent) run under the first authenticated user's token for the lifetime of the process.
IsSafeContent is called in at least six places across pkg/github/issues.go and pkg/github/pullrequests.go to decide whether to trust or sanitize content from external contributors.
PoC
The following program demonstrates that two distinct GraphQL clients produce the same singleton pointer, confirming that the second client is discarded:
package main
import (
"fmt"
"net/http"
"github.com/github/github-mcp-server/pkg/lockdown"
"github.com/shurcooL/githubv4"
)
func main() {
httpClientA := &http.Client{}
httpClientB := &http.Client{}
gqlClientA := githubv4.NewEnterpriseClient("https://api.github.com/graphql", httpClientA)
gqlClientB := githubv4.NewEnterpriseClient("https://api.github.com/graphql", httpClientB)
fmt.Printf("gqlClientA (user A token): %p\n", gqlClientA)
fmt.Printf("gqlClientB (user B token): %p\n", gqlClientB)
fmt.Printf("clients are different objects: %v\n\n", gqlClientA != gqlClientB)
instanceForA := lockdown.GetInstance(gqlClientA)
instanceForB := lockdown.GetInstance(gqlClientB)
fmt.Printf("lockdown instance returned for user A: %p\n", instanceForA)
fmt.Printf("lockdown instance returned for user B: %p\n", instanceForB)
fmt.Printf("same singleton returned for both users: %v\n", instanceForA == instanceForB)
}
Output:
gqlClientA (user A token): 0x400044070
gqlClientB (user B token): 0x400044078
clients are different objects: true
lockdown instance returned for user A: 0x400002ecc0
lockdown instance returned for user B: 0x400002ecc0
same singleton returned for both users: true
Impact
This affects deployments running the HTTP server with --lockdown-mode, which is the intended configuration for multi-user scenarios such as GitHub Copilot's managed MCP endpoint.
Three concrete consequences:
First, the ViewerLogin field in cache entries always reflects the first authenticated user's identity. The IsSafeContent check repoInfo.ViewerLogin == strings.ToLower(username) compares this stale value against each subsequent user's login, producing incorrect results for all users except the first.
Second, repository visibility and collaborator access data stored in the cache is evaluated through the first user's token. If user A cannot see a private repository but user B can (or vice versa), the cached isPrivate and hasPushAccess values will reflect user A's view of that repository, causing IsSafeContent to return wrong decisions for user B. In lockdown mode, a wrong true result means potentially injected content from untrusted external contributors is passed to the model without sanitization.
Third, if the first user's token is revoked or expires, all subsequent lockdown GraphQL queries fail with authentication errors. Since getRepoAccessInfo propagates these errors, IsSafeContent returns an error for every request, breaking lockdown protection for all users until the process is restarted.
Severity
6.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/github/github-mcp-server"
},
"ranges": [
{
"events": [
{
"introduced": "0.22.0"
},
{
"fixed": "1.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48529"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T21:32:09Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nWhen running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens.\n\n### Details\n\nThe singleton is defined in pkg/lockdown/lockdown.go:\n\n```go\nvar (\n instance *RepoAccessCache\n instanceMu sync.Mutex\n)\n\nfunc GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {\n instanceMu.Lock()\n defer instanceMu.Unlock()\n if instance == nil {\n instance = \u0026RepoAccessCache{\n client: client, // only stored on first call\n }\n }\n return instance // subsequent callers receive the same object regardless of their client\n}\n```\n\nIn HTTP mode, pkg/github/dependencies.go calls this per request:\n\n```go\nfunc (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAccessCache, error) {\n gqlClient, err := d.GetGQLClient(ctx) // creates client with request\u0027s token\n ...\n instance := lockdown.GetInstance(gqlClient, d.RepoAccessOpts...)\n // gqlClient is silently dropped if singleton already exists\n return instance, nil\n}\n```\n\nThe singleton\u0027s internal client field is never updated after the first initialization. All lockdown GraphQL queries that check repository access and visibility (queryRepoAccessInfo, called by IsSafeContent) run under the first authenticated user\u0027s token for the lifetime of the process.\n\nIsSafeContent is called in at least six places across pkg/github/issues.go and pkg/github/pullrequests.go to decide whether to trust or sanitize content from external contributors.\n\n### PoC\n\nThe following program demonstrates that two distinct GraphQL clients produce the same singleton pointer, confirming that the second client is discarded:\n\n```go\npackage main\n\nimport (\n \"fmt\"\n \"net/http\"\n \"github.com/github/github-mcp-server/pkg/lockdown\"\n \"github.com/shurcooL/githubv4\"\n)\n\nfunc main() {\n httpClientA := \u0026http.Client{}\n httpClientB := \u0026http.Client{}\n gqlClientA := githubv4.NewEnterpriseClient(\"https://api.github.com/graphql\", httpClientA)\n gqlClientB := githubv4.NewEnterpriseClient(\"https://api.github.com/graphql\", httpClientB)\n\n fmt.Printf(\"gqlClientA (user A token): %p\\n\", gqlClientA)\n fmt.Printf(\"gqlClientB (user B token): %p\\n\", gqlClientB)\n fmt.Printf(\"clients are different objects: %v\\n\\n\", gqlClientA != gqlClientB)\n\n instanceForA := lockdown.GetInstance(gqlClientA)\n instanceForB := lockdown.GetInstance(gqlClientB)\n\n fmt.Printf(\"lockdown instance returned for user A: %p\\n\", instanceForA)\n fmt.Printf(\"lockdown instance returned for user B: %p\\n\", instanceForB)\n fmt.Printf(\"same singleton returned for both users: %v\\n\", instanceForA == instanceForB)\n}\n```\n\nOutput:\n\n```\ngqlClientA (user A token): 0x400044070\ngqlClientB (user B token): 0x400044078\nclients are different objects: true\n\nlockdown instance returned for user A: 0x400002ecc0\nlockdown instance returned for user B: 0x400002ecc0\nsame singleton returned for both users: true\n```\n\n\u003cimg width=\"1642\" height=\"450\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bec46420-9ba7-458e-8710-62f951cb836a\" /\u003e\n\n\n### Impact\n\nThis affects deployments running the HTTP server with --lockdown-mode, which is the intended configuration for multi-user scenarios such as GitHub Copilot\u0027s managed MCP endpoint.\n\nThree concrete consequences:\n\nFirst, the ViewerLogin field in cache entries always reflects the first authenticated user\u0027s identity. The IsSafeContent check `repoInfo.ViewerLogin == strings.ToLower(username)` compares this stale value against each subsequent user\u0027s login, producing incorrect results for all users except the first.\n\nSecond, repository visibility and collaborator access data stored in the cache is evaluated through the first user\u0027s token. If user A cannot see a private repository but user B can (or vice versa), the cached isPrivate and hasPushAccess values will reflect user A\u0027s view of that repository, causing IsSafeContent to return wrong decisions for user B. In lockdown mode, a wrong true result means potentially injected content from untrusted external contributors is passed to the model without sanitization.\n\nThird, if the first user\u0027s token is revoked or expires, all subsequent lockdown GraphQL queries fail with authentication errors. Since getRepoAccessInfo propagates these errors, IsSafeContent returns an error for every request, breaking lockdown protection for all users until the process is restarted.",
"id": "GHSA-pjp5-fpmr-3349",
"modified": "2026-06-25T21:32:09Z",
"published": "2026-06-25T21:32:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"
},
{
"type": "PACKAGE",
"url": "https://github.com/github/github-mcp-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…