Claude Code Action MCP Config Injection via Malicious PR (.mcp.json RCE)
First seen Jul 18, 2026 · Updated Jul 18, 2026
Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.
Technical Analysis
The action's default configuration read .mcp.json and .claude/ settings from the untrusted PR head branch rather than the trusted base branch, and the enableAllProjectMcpServers setting caused all MCP servers declared in that file to be automatically loaded and executed without validation or approval. An attacker forks or opens a PR containing a crafted .mcp.json pointing to an attacker-controlled or malicious MCP server/command; when a privileged user or automated trigger (e.g., a maintainer comment or auto-run workflow) invokes Claude Code on the PR, the runner executes attacker-supplied MCP server code with the permissions of the workflow, including access to repository secrets and tokens. This crosses a trust boundary between untrusted contributor content and privileged CI execution, turning an agent tool-loading mechanism (MCP server auto-enablement) into a supply-chain code execution and secrets-exfiltration primitive. The fix restores .claude/ and .mcp.json from the base branch before CLI execution, removing attacker control over the configuration that determines which MCP servers run.
Affected Systems
Claude Code Action; protocols: MCP
Detection Signatures
- Pull requests modifying or adding .mcp.json or .claude/ directory contents from fork/external branches
- Workflow runs invoking Claude Code Action prior to v1.0.74 on PR head refs
- Unexpected outbound network connections from GitHub Actions runners during Claude Code invocation
- MCP server entries in .mcp.json referencing unfamiliar commands, scripts, or external domains
- Secrets/environment variable access patterns inconsistent with the declared workflow purpose
Remediation Steps
- 1
Upgrade Claude Code Action
Update to version 1.0.74 or later, which restores .claude/ and .mcp.json from the trusted base branch before execution.
- 2
Restrict MCP server auto-enablement
Disable enableAllProjectMcpServers or require explicit allow-listing/manual approval of MCP servers before they are executed in CI.
- 3
Isolate PR-triggered workflows
Run PR-triggered agent actions in workflows with minimal or no secrets access (e.g., use pull_request_target carefully, or separate jobs with restricted permissions) and require manual approval for first-time/external contributors.
- 4
Validate configuration source
Ensure any agent/tool configuration files (.mcp.json, tool manifests) are always sourced from the trusted base branch/commit, never from attacker-controlled PR content.
- 5
Audit historical PR activity
Review past PRs that modified .mcp.json or .claude/ and check for anomalous secret usage or outbound connections in corresponding workflow runs.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.