CVE-2026-48529

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48529", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-21T16:18:10.619Z", "datePublished": "2026-06-26T16:33:32.688Z", "dateUpdated": "2026-06-27T02:43:34.588Z"}, "containers": {"cna": {"title": "GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"}], "affected": [{"vendor": "github", "product": "github-mcp-server", "versions": [{"version": ">= 0.22.0, < 1.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:33:32.688Z"}, "descriptions": [{"lang": "en", "value": "GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2."}], "source": {"advisory": "GHSA-pjp5-fpmr-3349", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-27T02:42:44.775898Z", "id": "CVE-2026-48529", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-27T02:43:34.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48529", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-27T02:42:44.775898Z"}}}], "references": [{"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-27T02:43:21.930Z"}}], "cna": {"title": "GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion", "source": {"advisory": "GHSA-pjp5-fpmr-3349", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "github", "product": "github-mcp-server", "versions": [{"status": "affected", "version": ">= 0.22.0, < 1.1.2"}]}], "references": [{"url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "name": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:33:32.688Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48529", "state": "PUBLISHED", "dateUpdated": "2026-06-27T02:43:34.588Z", "dateReserved": "2026-05-21T16:18:10.619Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T16:33:32.688Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "github-mcp-server", "vendor": "github", "versions": [{"status": "affected", "version": ">= 0.22.0, < 1.1.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2."}, {"lang": "es", "value": "GitHub MCP Server es el servidor oficial de MCP de GitHub. Desde la versi\u00f3n 0.22.0 hasta la 1.1.2, cuando se ejecuta en modo HTTP con --lockdown-mode habilitado, el RepoAccessCache se implementa como un singleton global de proceso inicializado con el cliente GraphQL del primer usuario autenticado. Todas las solicitudes subsiguientes de diferentes usuarios comparten este singleton y sus consultas GraphQL relacionadas con el modo de bloqueo se ejecutan utilizando las credenciales del primer usuario. El singleton nunca se actualiza para reflejar los tokens de usuarios posteriores. Esta vulnerabilidad se corrige en la versi\u00f3n 1.1.2."}], "id": "CVE-2026-48529", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48529", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-27T02:42:44.775898Z", "version": "2.0.3"}}]}, "published": "2026-06-26T17:16:33.820", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.22.0,1.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "github-mcp-server", "source": "cna", "vendor": "github"}, "product": "github-mcp-server", "vendor": "github"}], "created": "2026-06-26T17:30:05.773839+00:00", "updated": "2026-06-29T20:06:16.408673+00:00", "vendors": ["github", "github$PRODUCT$github-mcp-server"]}