GitHub MCP exploited: Accessing private repositories via MCP (invariantlabs.ai)

Article summary

A critical vulnerability in the GitHub MCP server allows attackers to access private repository data by hijacking a user's agent via a malicious GitHub Issue. The vulnerability is not specific to any particular agent or MCP client and affects any agent that uses the GitHub MCP server. The attack can be triggered by a user querying their agent to look at issues in a public repository, which can lead to the agent fetching issues and getting injected with malicious code. This can result in the agent leaking private repository data into a public repository.

Main themes

• GitHub MCP server vulnerability
• LLM security risks
• access control and permissions
• user responsibility and awareness
• capability-based systems
• security vulnerability reporting

What commenters say

• The vulnerability is a result of poor design and lack of fine-grained access controls in the GitHub MCP server.
• Users are to blame for not properly configuring permissions and blindly trusting LLMs with broad access tokens.
• The issue is not with the LLM itself, but with the permissions boundary and the ease of exploiting it.
• Fine-grained token permissions are too complex for most users to understand and use effectively.
• The problem can be solved by implementing capability-based systems that restrict access to only what the user is allowed to do.
• Security vulnerabilities are often reported in a way that is overly complicated and states the obvious.
• The attack is only possible because users are allowing LLMs to run arbitrary prompts on their GitHub repos without proper validation.