Executive brief
GitHub MCP Server is a tool used to integrate GitHub data and functionality with AI models. A flaw in how the server handles specific requests allows an unauthenticated attacker to crash the service by sending a specially crafted message. This results in a total denial of service, preventing the AI tools from accessing GitHub data until the server is manually restarted.
Technical details
A vulnerability exists in the `CompletionsHandler` function within `pkg/github/server.go` of the GitHub MCP Server. The function attempts to access `params.Ref` without verifying if the pointer is nil. An attacker can trigger a Go runtime panic by sending a `completion/complete` JSON-RPC request that omits the `ref` field or contains empty parameters. Because this dereference occurs before authentication or token validation, any network-reachable client can crash the process. The issue is resolved in version 1.1.0 by implementing proper nil-guards on the request parameters.
Affected products
- GitHub github-mcp-server < 1.1.0
Timeline
- 2026-02-21: disclosed: Initial report to GitHub Open Source Security
- 2026-05-19: patched: Fix merged into main branch
- 2026-05-28: patched: Version 1.1.0 released
- 2026-07-20: advisory: GitHub Security Advisory published
- 2026-07-28: advisory: NVD published CVE-2026-47427