GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux, polaris, temporal, smokescreen, fluxcd-kustomize-mutating-webhook, newrelic-infra-operator, pluto, dataplaneapi, github-mcp-server, newrelic-k8s-metadata-injection, karpenter, flux-helm-controller, nova, flux-notification-controller, aws-network-policy-agent,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: victorialogs-fips, aws-load-balancer-controller, github-mcp-server, commercial-chainloop-cli, listmonk, cilium-fips, rabbitmq-messaging-topology-operator-fips, oras, grafana-operator-fips, pgwatch, clickhouse-operator, smokescreen, aws-eks-pod-identity-agent-fips,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: victorialogs-fips, aws-load-balancer-controller, github-mcp-server, commercial-chainloop-cli, listmonk, cilium-fips, rabbitmq-messaging-topology-operator-fips, oras, grafana-operator-fips, pgwatch, clickhouse-operator, smokescreen, aws-eks-pod-identity-agent-fips,...