A process-global singleton is used to cache a GitHub MCP Server GraphQL client when the server runs in HTTP mode with lockdown mode enabled. The singleton is initialized with the GraphQL client of the first user that authenticates. All later requests from other users share this same instance, meaning that the initial user’s credentials are re‑used for subsequent queries, and the client never updates to reflect new tokens. Consequently, users whose requests are executed under the first user’s credentials can read or act on data they should not be able to access, potentially exposing repository contents or mutating data in ways that violate authorization boundaries.

GitHub MCP Server (versions 0.22.0 through 1.1.1) are affected; the vulnerability was addressed in version 1.1.2. The issue manifests when the server is run in HTTP mode with the --lockdown-mode option enabled.

The CVSS score of 6 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation at the time. An attacker can trigger the flaw by authenticating as the first user in a multi‑user HTTP session and then having other users invoke GraphQL queries, which will run under the first user’s token. The attack vector is remote, exploiting the web interface of the MCP Server when lockdown mode is enabled.