CVE-2026-47751: Claude Code Action runs untrusted PR MCP configuration

Tracking: CVE-2026-47751
Severity: Medium

Who is affected

anthropics/claude-code-action before 1.0.74, in workflows that check out an untrusted PR head and invoke the action with project MCP servers enabled.

How the attack works

The action can load a PR-controlled .mcp.json with enableAllProjectMcpServers enabled by default. An attacker-controlled stdio MCP definition then starts a command on the GitHub Actions runner.

The workflow must actually invoke the action, for example through an authorized user's trigger or a configured automatic event. Merely opening a PR does not prove execution. If the runner receives secrets or a privileged token, the command may inherit access to them.

What to do

1. Upgrade to 1.0.74 or later and verify pinned action revisions resolve to a fixed release.
2. Review workflows that check out fork or PR content before running privileged automation. Do not automatically trust project MCP definitions from that content.
3. Inspect suspicious .mcp.json changes, workflow runs, child processes, and outbound activity. Revoke exposed workflow credentials where execution is confirmed or reasonably suspected.

Sources

• Original advisory or incident report