PT-2026-65504 · Github · Github Mcp Server

CVE-2026-47427 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitHub MCP Server versions prior to 1.1.0

Description A nil pointer dereference occurs in the CompletionsHandler() function within pkg/github/server.go when processing a completion/complete request. The issue arises because the server accesses the params.Ref variable without verifying if it is nil. An unauthenticated client can trigger a Go runtime panic by sending a JSON-RPC message with a missing or empty ref field. Since this crash happens before authentication or token validation, it allows any client capable of sending such messages to cause a complete denial of service.

Recommendations Update GitHub MCP Server to version 1.1.0.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-47427

GHSA-W4Q6-QW23-4RG7

Affected Products

Github Mcp Server

References · 7

• 🔥 https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47427 · Security Note
• https://osv.dev/vulnerability/GHSA-w4q6-qw23-4rg7 · Vendor Advisory
• https://github.com/github/github-mcp-server/pull/2502 · Note
• https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f58 · Note
• https://github.com/github/github-mcp-server/releases/tag/v1.1.0 · Note
• https://github.com/github/github-mcp-server · Note