al-ice.ai

GitHub MCP Server Panic Gets CVSS 7.5—but Remote Authentication Narrows the Exposure

AI CVEs by al-ice.ai Editorial

GitHub has published CVE-2026-47427, a denial-of-service vulnerability in the official GitHub MCP Server. A malformed Model Context Protocol completion/complete request can reach a missing reference value, trigger a nil-pointer dereference, and terminate the Go process.

The affected range is every version before 1.1.0. GitHub merged the three-line guard on May 19 and released version 1.1.0 on May 28; the GHSA and CVE record were published on July 28. Operators running an older binary or container should upgrade rather than rely on restart loops to absorb malformed input.

The CNA assigned CVSS 3.1 7.5 High, using a network, low-complexity, no-privilege vector with high availability impact. That score accurately reflects the CVE record’s broad scenario, but GitHub’s maintainer review documents a narrower default deployment threat model: local stdio exposure is self-denial-of-service by the spawning client, while the project’s remote service requires a token. The patch is unambiguous; the practical risk depends on how the server is exposed and supervised.

One missing object reached a Go type switch

The completions handler dispatched on req.Params.Ref.Type without first confirming that the request, parameters, and reference objects existed. An empty parameters object or a request missing ref could therefore make the handler dereference nil. In Go, the resulting panic terminates the process unless it is recovered higher in the call path.

The fix rejects all three missing-object cases before dispatch and returns the error missing required parameter: ref. GitHub also added regression tests for a nil request, nil parameters, and a nil reference. Version 1.1.0’s release notes describe the change as hardening malformed completion requests rather than a change to authentication or authorization.

This matters beyond one handler. Protocol parsers sit before the model’s reasoning and often before application-level policy. They need conventional input validation, bounded resource use, and panic isolation. Model guardrails cannot protect a server from a structural JSON-RPC object the program dereferences before any tool decision occurs.

The advisory and maintainer review describe different edges

The GitHub Security Advisory says the crash occurs before authentication or token validation and that any unauthenticated client able to send JSON-RPC messages can crash the server. The CVE record adopts that wording and scores the attack as network-accessible with no privileges.

The merged pull request adds an important deployment qualification. Its impact analysis says the local stdio server trusts the client that launched it, making the result self-DoS. For the project’s remote server, the maintainer states that the request is not reachable without a PAT or token and characterizes the impact as an authenticated caller crashing its own session.

Those statements are not interchangeable. A custom gateway, sidecar, proxy, or repackaged deployment may expose JSON-RPC before the project’s expected authentication boundary. A shared process may also give one authenticated tenant a larger availability blast radius than “their own session” suggests. Defenders should map the actual request path instead of inheriting either the maximum CVSS scenario or the narrowest upstream architecture by assumption.

Defensive priorities

  • Upgrade to GitHub MCP Server 1.1.0 or later. Confirm the version of the running binary or image digest; updating a manifest without replacing an existing workload is not remediation.
  • Trace completion/complete from the network edge to the handler. Verify where authentication occurs, whether any proxy forwards MCP messages before token validation, and whether anonymous clients can complete the protocol initialization sequence.
  • Determine the crash domain. Establish whether one panic kills a per-user process, a shared tenant service, or an entire gateway replica. Test restart behavior and capacity under repeated malformed requests in a controlled environment.
  • Keep remote MCP listeners private by default. Require authentication at the first reachable hop, apply rate limits and request-size limits there, and restrict network reachability independently of the server’s own token checks.
  • Alert on crash loops and malformed completion traffic. Correlate process exits, orchestration restarts, and repeated JSON-RPC validation errors. A public proof of concept exists, but the disclosure does not establish exploitation in the wild.
  • Fuzz protocol handlers as ordinary parsers. Exercise missing, null, wrong-type, oversized, and deeply nested values across every pre-auth method. Treat clean errors—not process recovery—as the required result.

The site’s MCP Python SDK origin-gate briefing showed how deployment context can turn a transport default into a remotely reachable boundary. Its json_repair CPU denial-of-service analysis makes the complementary point: availability controls belong in deterministic parsing and execution layers, before untrusted data reaches expensive or privileged work.

CVE-2026-47427 is a small patch with a useful architectural warning. “Pre-auth” is a property of a complete request path, not just the line that crashes, and “self-DoS” is only true when process and tenant boundaries actually align.

Sources: