CVE-2026-48529: GitHub MCP Server Auth Bypass Flaw

CVE-2026-48529 Overview

CVE-2026-48529 affects the GitHub MCP Server, GitHub's official Model Context Protocol (MCP) server implementation. The flaw exists in versions 0.22.0 through 1.1.1 when the server runs in HTTP mode with --lockdown-mode enabled. The RepoAccessCache component is initialized as a process-global singleton tied to the first authenticated user's GraphQL client. Subsequent requests from other users reuse that singleton, causing lockdown-related GraphQL queries to execute under the first user's credentials. The issue is categorized under [CWE-284] Improper Access Control and is fixed in version 1.1.2.

Critical Impact
Authenticated users can have their access decisions evaluated against another user's GitHub credentials, breaking tenant isolation in multi-user HTTP deployments.

Affected Products

GitHub MCP Server versions 0.22.0 through 1.1.1
Deployments running in HTTP mode with --lockdown-mode enabled
Multi-user environments sharing a single MCP server process

Discovery Timeline

2026-06-26 - CVE-2026-48529 published to NVD
2026-06-27 - Last updated in NVD database

Technical Details for CVE-2026-48529

Vulnerability Analysis

The GitHub MCP Server exposes GitHub repository operations to MCP clients such as AI assistants. When operators enable --lockdown-mode, the server enforces per-user repository access checks through a component called RepoAccessCache. This cache is intended to reduce GraphQL calls by memoizing repository access decisions.

The cache is instantiated as a process-global singleton on the first authenticated request. It captures the GraphQL client of the initial caller, including that user's authentication token. Because the singleton is never rebuilt or scoped per user, all later requests from different identities reuse the initial user's client for lockdown evaluation. The result is a state-management defect that undermines the access control boundary lockdown mode is designed to enforce.

Root Cause

The root cause is improper access control caused by shared mutable state across authentication contexts. The RepoAccessCache singleton binds to a single GraphQL client during initialization and holds it for the process lifetime. Session-scoped or request-scoped construction would have prevented credential reuse across users.

Attack Vector

An authenticated user issues an MCP request to a shared GitHub MCP Server running with --lockdown-mode. If that user is not the first caller, the lockdown check runs under the first user's token. Depending on the first user's repository permissions, the second user may see access decisions that reflect the wrong identity. Attack complexity is high because the attacker must reach a shared HTTP-mode instance where another user has already authenticated. Refer to the GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-48529

Indicators of Compromise

GraphQL audit log entries showing lockdown-related queries executed under a user token that does not match the requesting MCP session.
Repository access decisions in MCP server logs that diverge from the requesting user's expected GitHub permissions.
Long-lived GitHub MCP Server processes serving multiple distinct authenticated identities in HTTP mode.

Detection Strategies

Correlate MCP server request logs with GitHub GraphQL API audit logs to identify token-to-session mismatches.
Inventory running GitHub MCP Server instances and flag any version between 0.22.0 and 1.1.1 operating with --lockdown-mode.
Review deployment topology for shared multi-tenant MCP server processes exposed over HTTP.

Monitoring Recommendations

Enable verbose logging on the MCP server to capture the authenticated principal per request and compare against downstream GitHub API calls.
Alert on GitHub personal access token usage patterns that span multiple user sessions on the same MCP host.
Track version metadata for all deployed GitHub MCP Server instances through configuration management.

How to Mitigate CVE-2026-48529

Immediate Actions Required

Upgrade the GitHub MCP Server to version 1.1.2 or later on every host running in HTTP mode.
Rotate any GitHub tokens that were configured on shared MCP server instances during the affected window.
Restrict HTTP-mode MCP server access to trusted networks until patching is complete.

Patch Information

The vulnerability is fixed in GitHub MCP Server 1.1.2. Details are published in the GitHub Security Advisory GHSA-pjp5-fpmr-3349. Operators should pull the updated release artifact or container image and redeploy.

Workarounds

Disable --lockdown-mode until upgrading, accepting that lockdown enforcement is unavailable during that period.
Run a dedicated GitHub MCP Server process per authenticated user instead of a shared multi-user instance.
Switch the server to stdio transport for single-user workflows, avoiding the HTTP multi-user path entirely.

bash

# Upgrade the GitHub MCP Server container to the patched release
docker pull ghcr.io/github/github-mcp-server:1.1.2
docker stop github-mcp-server
docker rm github-mcp-server
docker run -d --name github-mcp-server \
  -e GITHUB_PERSONAL_ACCESS_TOKEN="$GITHUB_TOKEN" \
  ghcr.io/github/github-mcp-server:1.1.2 \
  --transport http --lockdown-mode