InvariantLabsAI/Blog/25/05/GitHub MCP Exploited: Accessing private repositories via MCP
- For security reasons, it should be obvious that one shouldn't mix the permission to write to a public repository with the permission to read from a private repository when using GitHub Fine-Grained Personal Access Tokens, and from that perspective this vulnerability's example feels like a contrived example.
- In my opinion, personal access token hygiene dictates that:
- engineers should create a new fine-grained personal access token for each project
- each fine-grained personal access token should never mix writing to a public and a private repository.
- That said, many developers will, out of laziness or ignorance, not realize that the scope of the PAT is the keyring of keys given over to an AI agent, so this is a worthwhile disclosure.
- But in my opinion, the most interesting part of this vulnerability is something not highlighted by the example in this disclosure - a random github issue on some random github project could taint the behavior of an otherwise trusted agent. This is more serious; it means that if the agent is working on library XYZ and queries library XYZ's github issues to inquire about an error, an attacker could in theory inject malicious code into the private repository via the AI agent using MCP.
Attack Setup
- In this attack setup, the user is using an MCP client like Claude Desktop with the Github MCP server connected to their account.
- We assume the user has created two repositories:
<user>/public-repo: A publicly accessible repository, allowing everyone on GitHub to create issues and bug reports.<user>/private-repo: A private repository, e.g. with proprietary code or private company data.
- By standard GitHub rules, an attacker can now create a malicious issue on the public repository, containing a prompt injection waiting for the agent to interact.
- The actual attack triggers as soon as the user and owner of the GitHub account queries their agent with a benign request, such as Have a look at the open issues in
<user>/public-repo, which will lead to the agent fetching the issues from the public repository and getting injected. - See below for an illustration of the ensuing flow.
- As shown here, as soon as the agent encounters the malicious GitHub issue, it can be coerced into pulling private repository data into context, and leaking it in an autonomously-created PR in the public repository, freely accessible to the attacker or anyone else.
- Toxic Flows We call this use of indirect prompt injection to trigger a malicious tool use sequence, a toxic agent flow. We have found this vulnerability by applying Invariant's security analyzer to GitHub MCP, allowing us to automate the process of discovering the flow in the wild.