GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.

Affected: Go: github.com/github/github-mcp-server

### Summary

When running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens.

### Details

The singleton is defined in pkg/lockdown/lockdown.go:

```go var ( instance *RepoAccessCache instanceMu sync.Mutex )

func GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache { instanceMu.Lock() defer instanceMu.Unlock() if instance == nil { instance = &RepoAccessCache{ client: client, // only stored on first call } } return instance // subsequent callers receive the same object regardless of their client } ```

In HTTP mode, pkg/github/dependencies.go calls this per request:

```go func (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAccessCache, error) { gqlClient, err := d.GetGQLClient(ctx) // creates client with request's token ... instance := lockdown.GetInstance(gqlClient, d.RepoAccessOpts...) // gqlClient is silently dropped if singleton already exists return instance, nil } ```

The singleton's internal client field is never updated after the first initialization. All lockdown GraphQL queries that check reposito…