What happened
NVD published CVE-2026-47427 (CVSS 7.5, High) on 2026-07-28, describing an unauthenticated denial-of-service in GitHub's official MCP Server caused by a missing nil check in the completion-request handler.
Why it matters
GitHub's MCP Server is a widely-deployed official integration point for AI coding agents; an unauthenticated, pre-auth crash means any agent workflow depending on it can be disrupted trivially, and the crash occurring before authentication means it's exploitable by any network-reachable client with zero credentials.
Attack vector
The CompletionsHandler function accesses params.Ref without a nil check; an unauthenticated client sending a completion/complete request with a missing or empty ref field triggers a Go runtime panic and crashes the server before any authentication or token validation occurs.
Affected systems
github/github-mcp-server before 1.1.0
Mitigation
Upgrade to github-mcp-server 1.1.0 or later.