CVE-2026-47751
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Published Jun 10, 2026 · updated Sep 15, 2026
Due to the combination of checking out PR head branches (attacker-controlled), reading from the working directory via default setting sources, and unconditionally enabling all project MCP servers via , it was possible for an attacker who opened a PR containing a malicious file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR. Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will have received this fix already Claude Code thanks hackerone.com/reptou for reporting this issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jun 10, 2026 · GitHub Advisory Database
Detected
Due to the combination of checking out PR head branches (attacker-controlled), reading from the working directory via default setting sources, and unconditionally enabling all project MCP servers via , it was possible for an attacker who opened a PR containing a malicious file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to
Sep 15, 2026 · GitHub Advisory Database
Fix available
anthropics/claude-code-action fixed in 1.0.74
Sep 15, 2026 · GitHub Advisory Database
Fix available
anthropics/claude-code-action fixed in 1.0.74
Sep 15, 2026 · GitHub Advisory Database
Updated
Due to the combination of checking out PR head branches (attacker-controlled), reading from the working directory via default setting sources, and unconditionally enabling all project MCP servers via , it was possible for an attacker who opened a PR containing a malicious file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to
Affected
- GitHub Actions anthropics/claude-code-action0 → 1.0.74
Sources
- CVE.orgVulnerability recordCVE-2026-47751
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-8q5r-mmjf-575q
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryGHSA-8q5r-mmjf-575q
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
osv.dev