{"id":"GO-2026-5779","revision":"aa054b02c42f4c6ab1c1aa71a15407ac","records":[{"revision":"aa054b02c42f4c6ab1c1aa71a15407ac","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5779","aliases":["CVE-2026-48529","GHSA-pjp5-fpmr-3349"],"title":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server","description":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:00:20.6611267+00:00","affected":[{"ecosystem":"Go","name":"github.com/github/github-mcp-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"1.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5779","license":"OSV · upstream source license applies","key":"osv:GO-2026-5779","identifiers":["GO-2026-5779","CVE-2026-48529","GHSA-pjp5-fpmr-3349"]},"retained":false,"historicalAffected":[]}],"coverage":[]}