Vulnerability advisory

CVE-2026-48529

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

Published Jun 26, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-pjp5-fpmr-3349GO-2026-5779

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/github/github-mcp-server ↗
6a57e75d729f9767827bc4f96e80ff9bd8538a46 to before b5397f6e3305531a1c534b90b2d347a70fa84da9	`b5397f6e3305531a1c534b90b2d347a70fa84da9`
Also listed as affected (29) `v1.1.1` `v1.1.0` `v1.0.5` `v1.0.4` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v0.33.1` `v0.33.0` `v0.32.0` `v0.31.0` `v0.30.3` `v0.30.2` `v0.30.1` `v0.30.0` `v0.29.0` `v0.28.1` `v0.28.0` `v0.27.0` `v0.26.3` `v0.26.2` `v0.26.1` `v0.26.0` `v0.25.0` `v0.24.1` `v0.24.0` `v0.22.0` `v0.23.0`

Description

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.

CVE-2026-48529

Affected versions

Repository

Description

References