Loading story…
GitHub MCP Server fixed a high-severity denial-of-service vulnerability, tracked as CVE-2026-47427 and GHSA-w4q6-qw23-4rg7, that allowed unauthenticated attackers to crash the service with malformed JSON-RPC completion requests. The flaw was caused by a nil pointer dereference in the server's completion handling logic when params.Ref was missing or empty, leading the Go process to panic before authentication and potentially taking the server offline.
The issue affected versions prior to 1.1.0 and was addressed by adding validation to reject invalid requests before dispatching on Ref.Type, along with tests covering missing references. CERT guidance warned that repeated exploitation could sustain outages for legitimate users and dependent integrations, and recommended upgrading to 1.1.0 or later, with additional protections such as reverse-proxy or API-gateway request validation and load balancing across multiple instances.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A patch for github-mcp-server was merged to prevent malformed completion requests with missing or empty parameters from triggering a nil pointer dereference and process panic in CompletionsHandler. The change rejected invalid requests before dispatching on Ref.Type and added tests for missing references; the issue was associated with advisory GHSA-w4q6-qw23-4rg7 and reported by @manthanghasadiya.
A Uganda National CERT advisory described CVE-2026-47427 as a high-severity denial-of-service flaw affecting GitHub MCP Server versions prior to 1.1.0, caused by a NULL pointer dereference when params.Ref is not checked for nil. The advisory said unauthenticated attackers could send crafted JSON-RPC completion requests to crash the server and recommended upgrading to version 1.1.0 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026
Two newly disclosed vulnerabilities affect widely used JavaScript server components, with one enabling **application-level denial of service** in `h3` and the other causing **cross-client data exposure** in `mcp-handler`. The `h3` flaw, tracked as `GHSA-Q5PR-72PQ-83V3`, is an algorithmic complexity issue in chunked cookie processing that lets an attacker send a very small HTTP request and force disproportionate CPU consumption. Rated **CVSS 7.5**, the bug can starve event loops and degrade availability without requiring privileges or user interaction. A separate issue in `mcp-handler`, tracked as `GHSA-W2FM-25VW-VH7F`, stems from a transport race condition that can leak sensitive MCP tool responses across client sessions. The vulnerability, rated **CVSS 7.1**, can expose database query results, local file contents, proprietary data, and raw large language model outputs, while also allowing limited attacker-controlled input injection when misrouted requests are processed in a victim session. The risk is highest in stateless serverless deployments such as **AWS Lambda** or edge runtimes where developers reuse global `McpServer` or `StreamableHTTPServerTransport` instances, while persistent Node.js deployments that create transport objects per connection are described as resistant to this specific flaw.
Jun 29, 2026
Anthropic fixed three vulnerabilities in its official *Git MCP server* (`mcp-server-git`) that could be triggered via **prompt injection** and chained with other MCP tools to achieve **remote code execution** or destructive file operations. The issues were reported by agentic AI security firm **Cyata**, which demonstrated that attacker-controlled content an AI assistant might read (for example, a malicious `README`, poisoned issue text, or other untrusted context) could drive the LLM to invoke MCP tool calls with crafted arguments, enabling exploitation without the attacker having direct access to the victim host. Cyata identified `CVE-2025-68143` (**unrestricted `git_init`**), `CVE-2025-68145` (**path validation bypass**), and `CVE-2025-68144` (**argument injection in `git_diff`**). In combination—particularly when `mcp-server-git` is used alongside the *Filesystem MCP server*—the flaws could enable code execution, arbitrary file deletion/overwrite, and reading arbitrary files into the LLM context (with Cyata noting this does not inherently provide direct exfiltration). The vulnerabilities affected default deployments of `mcp-server-git` prior to **version `2025.12.18`**; Anthropic was notified in June and shipped fixes in December, and there was no indication reported that the bugs were exploited in the wild.
Jun 29, 2026