Skip to content
OpenAdvisories

Package · Go

github.com/github/github-mcp-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Feed

  • High 7.5
    CVE-2026-47427

    GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

    GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field trigger…

    GitHub github-mcp-server github.com/github/github-mcp-server Go
  • Medium 6.0
    CVE-2026-48529

    GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

    GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client…

    GitHub github-mcp-server github.com/github/github-mcp-server Go