MCP Git repository confinement missed alternate object stores

A repository-controlled Git alternates file could cause Git-backed MCP read tools to access objects beyond the approved repository.

Entry and authority. The agent opens a repository containing a malicious or unexpected .git/objects/info/alternates reference.

Observed mechanism and consequence. Git resolves objects using an external object directory without applying the MCP server repository-boundary policy to that alternate.

Limits and status. Requires readable external object storage and suitable object identifiers; no field data theft or patch release is confirmed.

Git permits a repository to refer to alternate object stores through an objects/info/alternates configuration file. A repository-scoped MCP read tool may consequently retrieve object data from outside the intended repository without directly opening the external pathname supplied by a user. The reported scenario requires an attacker-controlled repository layout and accessible alternate data; it does not demonstrate that arbitrary files are exposed from every Git MCP host.

The November 11 follow-up advisory also describes a second, materially different path to the same repository confinement failure. A linked worktree has separate Git and common directories; treating their roles interchangeably lets an attacker-created nested repository redirect Git operations toward a private repository’s state. The earlier external-alternates path could read object data beyond the approved root. Both are included in the 2026.11.11 patch, but the reporter flags residual Windows junction caveats. No field intrusion or disclosure of a particular private repository has been confirmed.