CVE-2026-48529: GitHub MCP Server Credential Reuse in Lockdown Mode

Technical summary

The RepoAccessCache in affected versions is implemented as a process-global singleton initialized once when the first authenticated request arrives. The singleton stores a GraphQL client authenticated with that user's token. Because the singleton is never reinitializing or updated when subsequent users authenticate, all downstream lockdown-related GraphQL queries route through the cached client using only the first user's credentials. This violates the principle that each user's operations should be scoped to their own permissions. The vulnerability exists in the HTTP mode specifically when --lockdown-mode is enabled, suggesting the lockdown feature is meant to enforce stricter access policies that are instead being bypassed by credential reuse.

Business impact

Organizations running GitHub MCP Server in HTTP mode with lockdown mode enabled face unintended privilege escalation. A lower-privileged user joining a multi-user deployment could execute queries with the permissions of the first user to authenticate, potentially reading or modifying repositories or resources they lack direct access to. In development environments or automation platforms using GitHub MCP Server, this could lead to unauthorized code access, secrets exposure, or configuration changes. The impact is amplified in shared or multi-tenant scenarios where lockdown mode is explicitly chosen to enforce stricter controls.

Affected systems

GitHub MCP Server versions 0.22.0 through 1.1.1 are affected when deployed with both HTTP mode and --lockdown-mode enabled. The vulnerability does not apply to non-HTTP transports or deployments running without lockdown mode. Organizations should verify their deployment configuration and MCP Server version to determine exposure.

Exploitability

Exploitation requires authentication (an attacker must be a valid, authenticated user of the GitHub MCP Server instance) and a multi-user environment where the attacker can observe or infer the first user's access level. The HTTP mode and lockdown mode must both be active. While the CVSS score reflects medium severity and requires privileged access (PR:L), the practical risk depends on whether users trust that lockdown mode provides isolation and whether sensitive repositories or operations are protected only by that isolation.

Remediation

Upgrade GitHub MCP Server to version 1.1.2 or later. This version fixes the singleton credential caching issue by ensuring each user's GraphQL client and cached permissions are properly scoped. Verify the upgrade against the official GitHub MCP Server releases. Until patching, restrict HTTP mode deployments to single-user scenarios or disable --lockdown-mode if multi-user access is necessary.

Patch guidance

Update GitHub MCP Server to 1.1.2 or later. Follow your package manager or GitHub's official distribution channel for the update. After patching, restart all running instances to ensure the new version is active. No configuration changes are required post-patch; the fix is transparent to users. Test the deployment with multiple users to verify that each user's queries now execute under their own credentials.

Detection guidance

Review GitHub MCP Server deployment configurations in use across your infrastructure, noting which instances run --lockdown-mode in HTTP mode. In logs, look for GraphQL queries returning results inconsistent with the authenticated user's stated permissions, or queries that should fail under lockdown policies but succeed. Multi-user audit logs showing identical repository access patterns across different user accounts may also indicate cached credential reuse. Inspect process memory or configuration to confirm the singleton pattern is being used.

Why prioritize this

Although this vulnerability requires authentication and has a CVSS score of 6 (medium), it directly undermines the security guarantees of lockdown mode, which is a deliberate hardening feature. Deployments using lockdown mode are explicitly trying to enforce stricter access control; this flaw negates that intent. Multi-user or shared deployments are at particular risk of privilege escalation. It merits prompt patching despite the medium rating, especially in development environments where GitHub MCP Server may access sensitive code or CI/CD secrets.

Risk score, explained

The CVSS 3.1 score of 6 reflects a network-reachable attack vector (AV:N), high attack complexity due to the multi-user and specific configuration requirements (AC:H), and the need for legitimate authentication (PR:L). Impact is rated as low to moderate (C:L, I:L, A:L) because the attacker only gains the permissions of the first user and the scope changes (S:C) mean the compromise may affect other users on the same instance. The medium rating appropriately captures that this is a serious isolation flaw but requires specific conditions and authenticated access to exploit.

Frequently asked questions