{"id":"EUVD-2026-39809","enisaUuid":"8d4661dd-220a-3776-8663-253c40f013f6","description":"GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2.","datePublished":"Jun 26, 2026, 4:33:32 PM","dateUpdated":"Jun 27, 2026, 2:43:34 AM","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","references":"https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349\n","aliases":"CVE-2026-48529\nGHSA-pjp5-fpmr-3349\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"de5ca77c-fbfb-3dd8-841c-d8545e095722","product":{"name":"github-mcp-server","vendor":{"name":"GitHub"}},"product_version":"0.22.0, \u003c 1.1.2"}],"enisaIdVendor":[{"id":"c54ab01a-8c0c-32f0-a1ef-37af6c150f81","vendor":{"name":"GitHub"}}],"enisaIdVulnerability":[{"id":"93878aa0-7da5-3169-b4cf-df219e3aec59","vulnerability":{"id":"GHSA-pjp5-fpmr-3349","description":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion","datePublished":"Jun 25, 2026, 9:32:09 PM","dateUpdated":"Jun 25, 2026, 9:32:09 PM","baseScore":0.0,"references":"https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349\nhttps://github.com/github/github-mcp-server\n","enisa_id":"EUVD-2026-39809\n","aliases":"GHSA-pjp5-fpmr-3349\nCVE-2026-48529\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"95165089-fb55-367c-a2bd-447d76848583","vulnerability":{"id":"CVE-2026-48529","description":"GitHub MCP Server is GitHub\u0027s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user\u0027s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user\u0027s credentials. The singleton is never updated to reflect later users\u0027 tokens. This vulnerability is fixed in 1.1.2.","datePublished":"Jun 26, 2026, 4:33:32 PM","dateUpdated":"Jun 27, 2026, 2:43:34 AM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","references":"https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349\n","enisa_id":"EUVD-2026-39809\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Nov 3, 2026, 7:19:00 AM","vulnerabilityProduct":[{"id":"19bc6b1b-75a4-3291-93ea-382bd0e750bb","product":{"name":"github-mcp-server","vendor":{"name":"GitHub"}},"product_version":"0.22.0, \u003c 1.1.2"}],"vulnerabilityVendor":[{"id":"2464fa96-c292-37bf-a717-e2ce029e6779","vendor":{"name":"GitHub"}}]}}],"enisaIdAdvisory":[]}