Description
GitHub MCP Server is GitHub-s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user-s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user-s credentials. The singleton is never updated to reflect later users- tokens. This vulnerability is fixed in 1.1.2.
CVSS 6EPSS 0.13899999999999998%Risk 0.61
View source- Published
- 2026-06-26 17:16:33
- Affected versions
- >=0.22.0,<1.1.2
- Type
- Critical software
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L