CVE-2026-48529

6.0 Moyenne

Publiée le 26/06/2026 à 19:16 · Modifiée le 27/06/2026 à 06:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.

Traduire en français

Produits concernés

github-mcp-server

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.0 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-284

Références

https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349
https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories