MEDIUM6.0Go
GHSA-pjp5-fpmr-3349· CVE-2026-48529, GO-2026-5779GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
Modified: 7/7/2026
package
Go/github.com/github/github-mcp-server
pkg:go/github.com/github/github-mcp-server
HIGH7.5Go
GHSA-w4q6-qw23-4rg7· CVE-2026-47427, GO-2026-6118GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Modified: 8/18/2026
—Go
GO-2026-5779· CVE-2026-48529, GHSA-pjp5-fpmr-3349GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server
Modified: 7/7/2026
—Go
GO-2026-6118· CVE-2026-47427, GHSA-w4q6-qw23-4rg7GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server
Modified: 8/18/2026