CVE-2026-48529Published
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-48529 · Microsoft / collected KEV context
cve-program · CVE-2026-48529
euvd · EUVD-2026-39809
nvd · CVE-2026-48529
osv · GHSA-pjp5-fpmr-3349
- https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349
- https://github.com/github/github-mcp-server
osv · GO-2026-5779
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.