Medium, CVSS 5.3GitHub ActionsPublished
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
CVE-2026-47751 · GHSA-8q5r-mmjf-575q
- Affected
- GitHub Actions anthropics/claude-code-action < 1.0.74
- Fixed in
- 1.0.74· Vendor fix available
- Issue
- Due to the combination of checking out PR head branches (attacker-controlled), reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllProjectMcpServers, it was possible for an attacker who opened a PR containing a malicious .mcp.json file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR. Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will…
Recommended action: Upgrade to 1.0.74 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.