CVE-2026-47427 Details
Description
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.
A nil pointer dereference vulnerability has been identified in GitHub MCP Server versions prior to 1.1.0. The issue arises in the CompletionsHandler function, which accesses the ref parameter without checking for nil. This oversight allows a completion request with a missing or empty ref field to cause a runtime panic, crashing the server. The denial-of-service occurs before any authentication or token validation, enabling any unauthenticated client to disrupt the server by sending JSON-RPC messages.
Users can upgrade to GitHub MCP Server version 1.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f58 | [email protected] | Patch |
| https://github.com/github/github-mcp-server/pull/2502 | [email protected] | Issue TrackingPatch |
| https://github.com/github/github-mcp-server/releases/tag/v1.1.0 | [email protected] | Release Notes |
| https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github mcp server | < 1.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | Initial Analysis | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |