An unauthenticated information disclosure vulnerability in the GitHub MCP Agent allows attackers to steal sensitive API tokens and credentials due to improper process-wide environment variable handling.

This vulnerability occurs because the application stores user-supplied API tokens in global process environment variables using os.environ without session isolation. Since the Streamlit-based architecture serves multiple users from a single process, any unauthenticated attacker can retrieve tokens belonging to other users.

The vulnerability poses a severe risk to organizational security by exposing GitHub Personal Access Tokens and LLM API keys. Successful exploitation could lead to unauthorized access to private repositories, intellectual property theft, and financial abuse through unauthorized LLM usage. Given the CVSS score of 8.2, this represents a high-severity threat to data confidentiality and integrity.

Immediate Action: Since no patch is currently available, administrators should immediately restrict access to the affected service by placing it behind a secure VPN or an authenticated reverse proxy to prevent public exposure.

Proactive Monitoring: Review application logs for unusual access patterns or frequent requests from unauthorized IP addresses that may indicate an attempt to scrape environment variables.

Compensating Controls: Implement strict network-level segmentation to isolate the hosting environment and rotate any API keys or tokens that have been exposed or were in use during the period of vulnerability.

Public Exploit Available: Yes — a published proof-of-concept exists via the researcher's disclosure at the GitHub repository linked in the references.

Given the ease of exploitation and the critical nature of the exposed credentials, this vulnerability requires urgent attention. Until a vendor-supplied patch is released to provide proper session isolation, the application must be isolated from public networks to prevent potential credential harvesting.