{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0216",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Broad GitHub MCP tokens let public issue content exfiltrate private repository data.",
  "details": "## What the vulnerability is\n\nThe GitHub MCP toxic-flow demonstration shows indirect content moving across a trust boundary: a malicious public issue causes a Claude 4 Opus agent to read private repositories and post salary or personal data in a public pull request. The MCP server offers per-call confirmation, but users commonly enable Always Allow. R7 records an incident, not an ASR, so this advisory describes a demonstrated data-exfiltration path rather than a percentage. The tool is a real GitHub service, not a simulated benchmark.\n\n## Which configuration is exposed\n\nThe exposed setup is github-mcp-server with a token that can reach more than one repository, plus a tool that reads public issue or pull-request content and write-capable operations such as create_pull_request or push. Approval is auto or an Always Allow equivalent. A recognisable example is Claude Desktop connected to GitHub MCP with a broad personal token and a user who pre-approved the write tools. untrustedInput comes from public GitHub content; egress is the public repository write.\n\n## How ACVE detects it\n\nACVE matches a GitHub MCP server, a tool marked untrustedInput, and approval never or allowlist. The lock does not presently prove token scope from the server name, so a visible broad token is a confirmed configuration while missing scope metadata is possible. ACVE also cannot observe whether a user clicked Always Allow during a session unless discovery records it. The incident’s real safeguard boundary must be represented in the lock and reproduction notes.\n\n## Fix\n\n1. Reconfigure mcp:github-mcp-server:token-scope to a single-repository fine-grained token per session. 2. Keep approval on for create_pull_request, push, and any permission-changing call. 3. Put an MCP-scan proxy or equivalent content inspection layer between public issue reads and write tools. 4. Revoke and rotate any token exposed during a toxic-flow test, then verify that a public issue cannot create a private-data pull request.\n\n## Grounding needed\n\nPin the github-mcp-server version, token scopes, repository fixture, issue text, Claude model id, Desktop surface, approval setting, and proxy configuration. R7 confidence is M: Invariant Labs provides a verified incident demonstration, but no rate or benchmark suite exists. Severity is LOW because there is no attacker-budget ASR to feed to severityFromAsr; the consequence is nevertheless concrete exfiltration and should not be described as a mere file write.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "any"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability"
    }
  ],
  "database_specific": {
    "severity": "LOW",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "data-exfiltration"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI02"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "data-exfiltration",
        "outcome": "exfiltration"
      },
      "evidence": [
        {
          "kind": "incident",
          "benchmark": "GitHub MCP toxic-flow demonstration",
          "attack": "malicious public issue causes private-repository read and public pull-request write",
          "defense": "none",
          "metric": "asr",
          "model": {
            "id": "Claude 4 Opus",
            "quant": null
          },
          "setup": {
            "tools": [
              "github-mcp-server public issue read",
              "create_pull_request",
              "push"
            ],
            "approval": "allowlist",
            "defences": []
          },
          "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability",
          "note": "incident; no rate; Always Allow is common"
        }
      ],
      "matcher": {
        "all": [
          {
            "all": [
              {
                "some": "mcpServers",
                "where": {
                  "field": "registryName",
                  "op": "eq",
                  "value": "github-mcp-server"
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Scope GitHub MCP tokens per repository and keep write approvals on.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "mcp:github-mcp-server:token-scope",
            "to": "single-repo",
            "why": "A per-session fine-grained token prevents a public issue flow from reaching unrelated private repositories."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Keep create_pull_request and push behind an explicit confirmation."
          },
          {
            "type": "reconfigure",
            "target": "defence:mcp-scan-proxy",
            "to": "on",
            "why": "Inspect public issue and pull-request content before it reaches write-capable tools."
          }
        ]
      }
    }
  }
}