PT-2026-52644 · Github · Github Mcp Server

Published 2026-06-25 · Updated 2026-06-26 · CVE-2026-48529

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GitHub MCP Server versions 0.22.0 through 1.1.1

Description When operating in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton. This singleton is initialized using the GraphQL client of the first authenticated user, and subsequent requests from different users continue to use this same instance. Consequently, lockdown-related GraphQL queries are executed using the credentials of the first user rather than the current requester's token.

This issue affects the GetInstance() function in pkg/lockdown/lockdown.go, which fails to update the internal client when called by different users. This leads to incorrect results in the IsSafeContent() function, which relies on queryRepoAccessInfo to determine if content from external contributors should be trusted or sanitized. Potential impacts include incorrect repository visibility checks, unauthorized access to cached data based on the first user's permissions, and a total failure of lockdown protection if the first user's token expires.

Recommendations Update GitHub MCP Server to version 1.1.2.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-48529

GHSA-PJP5-FPMR-3349

Affected Products

Github Mcp Server

References · 4

• https://osv.dev/vulnerability/GHSA-pjp5-fpmr-3349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48529 · Security Note
• https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349 · Note
• https://github.com/github/github-mcp-server · Note