https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:52:35 +0000 https://cve.radiocsirt.org/vuln/cve-2026-48529 <p><strong>Affected:</strong> github-mcp-server</p> <p>GitHub MCP Server is GitHub&#39;s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user&#39;s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user&#39;s credentials. The singleton is never updated to reflect later users&#39; tokens. This vulnerability is fixed in 1.1.2.</p> <p><strong>Affected:</strong> github-mcp-server</p> <p>GitHub MCP Server is GitHub&#39;s official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user&#39;s GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user&#39;s credentials. The singleton is never updated to reflect later users&#39; tokens. This vulnerability is fixed in 1.1.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-48529