Skip to content
OpenAdvisories

Package · Go

github.com/github/github-mcp-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only

1 result · Clear filters · Feed

  • Medium 6.0
    CVE-2026-48529

    GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

    GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client…

    GitHub github-mcp-server github.com/github/github-mcp-server Go