{"id":"CVE-2026-48529","revision":null,"records":[{"revision":"ce050f1b60c9450784d0e531492698b0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48529","aliases":[],"title":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion","description":"GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.","state":0,"publishedAt":"2026-06-26T16:33:32.688+00:00","modifiedAt":"2026-06-27T02:43:34.588+00:00","affected":[{"ecosystem":"Vendor product","name":"github-mcp-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"github\",\n                    \"product\": \"github-mcp-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.22.0, < 1.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","score":6,"severity":"MEDIUM"}],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48529","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48529","identifiers":["CVE-2026-48529"]},"retained":false,"historicalAffected":[]},{"revision":"6ee70573627541e5bc784f59d9426f93","observedAt":"2026-11-07T11:30:12.057+00:00","statement":{"source":"euvd","id":"EUVD-2026-39809","aliases":["CVE-2026-48529","GHSA-pjp5-fpmr-3349"],"title":"GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated us…","description":"GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","score":6,"severity":null}],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39809","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 4:33:32 PM","dateUpdated":"Jun 27, 2026, 2:43:34 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39809","identifiers":["EUVD-2026-39809","CVE-2026-48529","GHSA-pjp5-fpmr-3349"]},"retained":false,"historicalAffected":[]},{"revision":"76c7dc65d7af4db89dc03d39f061afe2","observedAt":"2026-10-27T13:11:53.172+00:00","statement":{"source":"nvd","id":"CVE-2026-48529","aliases":[],"title":"GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated us…","description":"GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.","state":0,"publishedAt":"2026-06-26T17:16:33.82+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","score":6,"severity":"MEDIUM"}],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48529","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-284"],"productCriteria":[],"sourceDates":{"published":"2026-06-26T17:16:33.820","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48529","identifiers":["CVE-2026-48529"]},"retained":false,"historicalAffected":[]},{"revision":"717959f46b724888a6e9094c12958f21","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-pjp5-fpmr-3349","aliases":["CVE-2026-48529","GO-2026-5779"],"title":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion","description":"### Summary\n\nWhen running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens.\n\n### Details\n\nThe singleton is defined in pkg/lockdown/lockdown.go:\n\n```go\nvar (\n    instance   *RepoAccessCache\n    instanceMu sync.Mutex\n)\n\nfunc GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {\n    instanceMu.Lock()\n    defer instanceMu.Unlock()\n    if instance == nil {\n        instance = &RepoAccessCache{\n            client: client,  // only stored on first call\n        }\n    }\n    return instance  // subsequent callers receive the same object regardless of their client\n}\n```\n\nIn HTTP mode, pkg/github/dependencies.go calls this per request:\n\n```go\nfunc (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAccessCache, error) {\n    gqlClient, err := d.GetGQLClient(ctx)  // creates client with request's token\n    ...\n    instance := lockdown.GetInstance(gqlClient, d.RepoAccessOpts...)\n    // gqlClient is silently dropped if singleton already exists\n    return instance, nil\n}\n```\n\nThe singleton's internal client field is never updated after the first initialization. All lockdown GraphQL queries that check repository access and visibility (queryRepoAccessInfo, called by IsSafeContent) run under the first authenticated user's token for the lifetime of the process.\n\nIsSafeContent is called in at least six places across pkg/github/issues.go and pkg/github/pullrequests.go to decide whether to trust or sanitize content from external contributors.\n\n### PoC\n\nThe following program demonstrates that two distinct GraphQL clients produce the same singleton pointer, confirming that the second client is discarded:\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"net/http\"\n    \"github.com/github/github-mcp-server/pkg/lockdown\"\n    \"github.com/shurcooL/githubv4\"\n)\n\nfunc main() {\n    httpClientA := &http.Client{}\n    httpClientB := &http.Client{}\n    gqlClientA := githubv4.NewEnterpriseClient(\"https://api.github.com/graphql\", httpClientA)\n    gqlClientB := githubv4.NewEnterpriseClient(\"https://api.github.com/graphql\", httpClientB)\n\n    fmt.Printf(\"gqlClientA (user A token): %p\\n\", gqlClientA)\n    fmt.Printf(\"gqlClientB (user B token): %p\\n\", gqlClientB)\n    fmt.Printf(\"clients are different objects: %v\\n\\n\", gqlClientA != gqlClientB)\n\n    instanceForA := lockdown.GetInstance(gqlClientA)\n    instanceForB := lockdown.GetInstance(gqlClientB)\n\n    fmt.Printf(\"lockdown instance returned for user A: %p\\n\", instanceForA)\n    fmt.Printf(\"lockdown instance returned for user B: %p\\n\", instanceForB)\n    fmt.Printf(\"same singleton returned for both users: %v\\n\", instanceForA == instanceForB)\n}\n```\n\nOutput:\n\n```\ngqlClientA (user A token): 0x400044070\ngqlClientB (user B token): 0x400044078\nclients are different objects: true\n\nlockdown instance returned for user A: 0x400002ecc0\nlockdown instance returned for user B: 0x400002ecc0\nsame singleton returned for both users: true\n```\n\n<img width=\"1642\" height=\"450\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bec46420-9ba7-458e-8710-62f951cb836a\" />\n\n\n### Impact\n\nThis affects deployments running the HTTP server with --lockdown-mode, which is the intended configuration for multi-user scenarios such as GitHub Copilot's managed MCP endpoint.\n\nThree concrete consequences:\n\nFirst, the ViewerLogin field in cache entries always reflects the first authenticated user's identity. The IsSafeContent check `repoInfo.ViewerLogin == strings.ToLower(username)` compares this stale value against each subsequent user's login, producing incorrect results for all users except the first.\n\nSecond, repository visibility and collaborator access data stored in the cache is evaluated through the first user's token. If user A cannot see a private repository but user B can (or vice versa), the cached isPrivate and hasPushAccess values will reflect user A's view of that repository, causing IsSafeContent to return wrong decisions for user B. In lockdown mode, a wrong true result means potentially injected content from untrusted external contributors is passed to the model without sanitization.\n\nThird, if the first user's token is revoked or expires, all subsequent lockdown GraphQL queries fail with authentication errors. Since getRepoAccessInfo propagates these errors, IsSafeContent returns an error for every request, breaking lockdown protection for all users until the process is restarted.","state":0,"publishedAt":"2026-06-25T21:32:09+00:00","modifiedAt":"2026-07-07T16:11:35.1579353+00:00","affected":[{"ecosystem":"Go","name":"github.com/github/github-mcp-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"1.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349","https://github.com/github/github-mcp-server"],"sourceUrl":"https://github.com/advisories/GHSA-pjp5-fpmr-3349","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pjp5-fpmr-3349","identifiers":["GHSA-pjp5-fpmr-3349","CVE-2026-48529","GO-2026-5779"]},"retained":false,"historicalAffected":[]},{"revision":"aa054b02c42f4c6ab1c1aa71a15407ac","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5779","aliases":["CVE-2026-48529","GHSA-pjp5-fpmr-3349"],"title":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server","description":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:00:20.6611267+00:00","affected":[{"ecosystem":"Go","name":"github.com/github/github-mcp-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"1.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5779","license":"OSV · upstream source license applies","key":"osv:GO-2026-5779","identifiers":["GO-2026-5779","CVE-2026-48529","GHSA-pjp5-fpmr-3349"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}