ACVE-2026-0216 · Hijack shown in a test · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The agent reads the planted issue, pulls the user's private repositories into context and opens a public pull request containing their contents.

THE SETUP — is yours like this?

Harness: Claude Desktop, invariantlabs.ai
Model: Claude 4 Opus, invariantlabs.ai
Goal: Have a look at the open issues in <user>/public-repo, invariantlabs.ai
Tools: The official GitHub MCP server with a personal access token spanning the user's public and private repositories; its issue-reading, repository-reading and pull-request-creating tools, invariantlabs.ai
Approval: The user had chosen Claude Desktop's Always Allow policy for tool calls, which the post says many users opt for, invariantlabs.ai

WHAT TO CHANGE

Scope the GitHub token to the repositories in use and keep write tools behind confirmation.

Reconfigure mcp:github-mcp-server:env.GITHUB_PERSONAL_ACCESS_TOKEN to fine-grained token limited to selected repositories. The agent cannot read repositories the token cannot reach. Owner: operator
Reconfigure mcp:github-mcp-server:args to --read-only or --lockdown-mode. Read-only mode removes the write channel; lockdown mode withholds public content from authors without push access. GitHub documents lockdown mode as best-effort, not an authorization boundary. Owner: operator
Reconfigure agent.approval to ask. Pull-request and push calls are confirmed by a person. Owner: operator
Reconfigure github.github-mcp-server.lockdownMode to on by default for public repository content. Recommended: the injection arrived as an issue in a public repository. Owner: tool-provider
Reconfigure anthropic.claude-desktop.alwaysAllow to tools that publish content, such as opening a pull request, still confirmed. Recommended: the private data left through a public pull request opened without a prompt. Owner: harness-vendor

HARM, REACH AND RECOVERY

Harm: data-exfiltration
Reach: The user's private GitHub repositories, invariantlabs.ai (private repositories)
Condition: When a planted issue is read with a token that spans public and private repositories, invariantlabs.ai
Evidence and responses: Demonstrated · researcher report

SOURCES

Technical details

Private repositories are published in a public pull request when Claude 4 Opus in Claude Desktop, with the GitHub MCP server on Always Allow, reads an issue planted in the user's public repository.

Severity: HIGH · harm and reach
Status: Unverified
Kind: Hijack shown in a test
Modified: 2026-09-25
Aliases: No CVE assigned — the reporter states it is not a flaw in the server code; no CVE was assigned
CVE boundary: combination
Affected: Go: github.com/github/github-mcp-server — all versions
Harness/product: github.com/github/github-mcp-server
Classes: prompt-injection-to-tool; data-exfiltration; CWE-1427; CWE-359
Taxonomy: LLM: LLM01; ASI: ASI01; ASI: ASI03; ASI: ASI02; ATLAS: AML.T0093; ATLAS: AML.T0051.001; ATLAS: AML.T0086
First reported: 2025-05-26 — Invariant Labs
Input controlled by: content-author
Divergence: goal-hijacked
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference))

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

content-author · prompt-injection · exfiltration

What

Invariant Labs (2025-05-26) planted an issue in a user's public repository. Asked to look at open issues, the agent read the user's private repositories and published their contents, including salary details, in a public pull request. Invariant states this is "not a flaw in the GitHub MCP server code itself"; the token reached public and private repositories alike.

Detection

The lockfile sees the GitHub MCP server and the approval mode; it sees neither the token's repository scope nor Claude Desktop's Always Allow choice.

Fix

Use a fine-grained token limited to the repositories in use; keep confirmation on for write tools; consider the server's --read-only and --lockdown-mode flags. The post also recommends Invariant Guardrails and MCP-scan, which are Invariant's own products.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  some mcpServers where
    or
      package in ["pkg:oci/ghcr.io/github/github-mcp-server","pkg:golang/github.com/github/github-mcp-server"]
      urlHost eq "api.githubcopilot.com"
  approval in ["never","allowlist"]

Report a problem JSON