CVE-2026-47427: GitHub MCP Server DOS Vulnerability

CVE-2026-47427 Overview

CVE-2026-47427 is a nil pointer dereference vulnerability [CWE-476] in the GitHub MCP Server, GitHub's official Model Context Protocol (MCP) server implementation. The flaw exists in the CompletionsHandler function within pkg/github/server.go, which accesses params.Ref without a nil check. An unauthenticated attacker can send a crafted completion/complete JSON-RPC request with a missing or empty ref field to trigger a Go runtime panic. The crash occurs before authentication or token validation, allowing any client capable of reaching the server to cause a full denial of service. The issue is fixed in version 1.1.0.

Critical Impact
Any unauthenticated network attacker can crash the GitHub MCP Server with a single malformed JSON-RPC request, disrupting all MCP-dependent workflows and AI integrations.

Affected Products

GitHub MCP Server versions prior to 1.1.0
pkg/github/server.goCompletionsHandler function
Deployments exposing the MCP JSON-RPC interface to untrusted clients

Discovery Timeline

2026-07-28 - CVE-2026-47427 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-47427

Vulnerability Analysis

The vulnerability is a classic null pointer dereference in Go server code handling MCP completion requests. The CompletionsHandler function receives a *mcp.CompleteRequest and immediately reads req.Params.Ref.Type without validating whether req, req.Params, or req.Params.Ref are non-nil. When a JSON-RPC client sends a completion/complete request that omits the ref object or supplies an empty value, the Go runtime raises a panic on the nil dereference. Because the handler does not recover from panics, the entire server process terminates.

The most consequential aspect is placement in the request pipeline. The dereference happens before the server invokes authentication or GitHub token validation logic. An attacker never needs credentials, session state, or prior interaction to cause the fault. A single unauthenticated JSON-RPC message is sufficient to make the server unavailable to every legitimate consumer.

Root Cause

The root cause is missing input validation on pointer-typed fields inside a deserialized JSON-RPC payload. Go's JSON decoder leaves optional message fields as nil when the client omits them. The handler assumed that clients would always populate ref, so it skipped defensive nil checks and used pointer chasing directly. This is the pattern captured by [CWE-476: NULL Pointer Dereference].

Attack Vector

Exploitation requires network access to the MCP server's JSON-RPC endpoint and no authentication. The attacker sends a completion/complete request with params.ref absent or explicitly null. The server panics, terminating the process and dropping all in-flight connections. Repeated requests against auto-restarting deployments produce a sustained denial of service against any AI agent, IDE plugin, or automation platform that relies on the MCP endpoint.

// Security patch in pkg/github/server.go from PR #2502
func CompletionsHandler(getClient GetClientFn) func(ctx context.Context, req *mcp.CompleteRequest) (*mcp.CompleteResult, error) {
	return func(ctx context.Context, req *mcp.CompleteRequest) (*mcp.CompleteResult, error) {
+		if req == nil || req.Params == nil || req.Params.Ref == nil {
+			return nil, fmt.Errorf("missing required parameter: ref")
+		}
		switch req.Params.Ref.Type {
		case "ref/resource":
			if strings.HasPrefix(req.Params.Ref.URI, "repo://") {

Source: GitHub MCP Server commit c88d2ec. The patch adds an explicit guard that returns a structured error before any pointer dereference, preventing the panic.

Detection Methods for CVE-2026-47427

Indicators of Compromise

Unexpected termination of the GitHub MCP Server process accompanied by a Go runtime error: invalid memory address or nil pointer dereference panic in stdout or stderr logs.
JSON-RPC request logs containing "method":"completion/complete" with missing, null, or empty params.ref values immediately preceding a crash.
Repeated MCP client reconnect attempts and 5xx or transport-closed errors reported by downstream AI agents or IDE integrations.

Detection Strategies

Alert on Go panic stack traces referencing CompletionsHandler or pkg/github/server.go in application logs.
Deploy JSON-RPC request inspection at a reverse proxy or API gateway to flag completion/complete messages with missing ref fields.
Correlate MCP process restarts with source IPs that recently sent malformed JSON-RPC payloads to identify probing behavior.

Monitoring Recommendations

Track MCP server uptime, restart counts, and panic frequency as first-class SRE metrics.
Forward MCP application logs to a centralized logging platform and build detections on nil pointer panic signatures.
Monitor authentication metrics: a spike in unauthenticated crashes without corresponding successful logins is a strong exploitation signal.

How to Mitigate CVE-2026-47427

Immediate Actions Required

Upgrade GitHub MCP Server to version 1.1.0 or later, which contains the nil check fix from PR #2502.
Restrict network exposure of the MCP JSON-RPC endpoint so only trusted clients and authenticated networks can reach it.
Review the GitHub Security Advisory GHSA-w4q6-qw23-4rg7 for vendor guidance and confirm patched binaries in production.

Patch Information

The fix is available in GitHub MCP Server release v1.1.0. Commit c88d2ec adds explicit nil checks for req, req.Params, and req.Params.Ref in CompletionsHandler and returns a missing required parameter: ref error instead of dereferencing the pointer.

Workarounds

Place the MCP server behind a reverse proxy or WAF that validates JSON-RPC payloads and rejects completion/complete requests lacking a populated ref object.
Enforce network-level access controls (mTLS, IP allowlists, private networking) so unauthenticated attackers cannot deliver JSON-RPC messages.
Run the MCP server under a process supervisor with rate-limited restarts and alerting to reduce downtime while patching is scheduled.

bash

# Verify installed GitHub MCP Server version and upgrade
github-mcp-server --version

# Docker deployments: pull the patched image tag
docker pull ghcr.io/github/github-mcp-server:v1.1.0
docker stop github-mcp-server && docker rm github-mcp-server
docker run -d --name github-mcp-server \
  --restart=on-failure:5 \
  ghcr.io/github/github-mcp-server:v1.1.0

# Go module consumers: bump the dependency
go get github.com/github/github-mcp-server@v1.1.0
go mod tidy