CVE-2026-48529: GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

June 25, 2026

When running in HTTP mode with –lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user’s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user’s credentials. The singleton is never updated to reflect later users’ tokens.

References

github.com/advisories/GHSA-pjp5-fpmr-3349
github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349
nvd.nist.gov/vuln/detail/CVE-2026-48529

Code Behaviors & Features

Detect and mitigate CVE-2026-48529 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →