Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure, Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-78.
Summary
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| anthropics | claude-code-action | before 1.0.74 | 1.0.74 | Patch available | CNA |
| — | anthropics/claude-code-action (GitHub Actions) | before 1.0.74 | 1.0.74 | Patch available | GHSA-8q5r-mmjf-575q |
- claude-code-action Vendoranthropics Affected before 1.0.74 Fixed in 1.0.74 Patch available CNA
- anthropics/claude-code-action (GitHub Actions) Vendor— Affected before 1.0.74 Fixed in 1.0.74 Patch available GHSA-8q5r-mmjf-575q
Remediation
- Fix · CNA claude-code-action (anthropics) Fixed in 1.0.74
- Fix · GHSA-8q5r-mmjf-575q anthropics/claude-code-action (GitHub Actions) Fixed in 1.0.74 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47751
- 2026-10-03 Alias added: GHSA-8q5r-mmjf-575q
References
Other 5
- https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q
- https://github.com/anthropics/claude-code-action/pull/1066
- https://github.com/anthropics/claude-code-action/commit/9ddce40de8c1ab71fb6303a125fdad0968dc1312
- https://github.com/anthropics/claude-code-action/releases/tag/v1.0.74
- https://github.com/anthropics/claude-code-action
More anthropics vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
- TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
- TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
- TI-2025-24240 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling CVSS 4.0CRITICAL 9.3
- TI-2025-32918 Claude Code IDE extensions allow websocket connections from arbitrary origins CVSS 4.0HIGH 8.8
Sources
- CVE-2026-47751 · CVE Program
- CVE-2026-47751 · NVD
- FIRST EPSS
- GHSA-8q5r-mmjf-575q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences