github.com/github/github-mcp-server vulnerabilities
CVEs whose affected-version data names the github.com/github/github-mcp-server package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-47427High· 7.5GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
▾ Twilightgithub · github.com/github/github-mcp-serverEPSS 0.44%via GHSA
CVE-2026-48529Medium· 6.0GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
▾ Sunlitgithub · github.com/github/github-mcp-serverEPSS 0.21%via GHSA