Skip to content

[container-image-scan] MCP Gateway CVE burn-down #65793

Closed as not planned
Closed as not planned
[container-image-scan] MCP Gateway CVE burn-down#65793
Assignees
pelikhan
Labels
cookieIssue Monster Loves Cookies!security

Description

@github-actions
github-actions
bot
opened on Oct 5, 2026

Overview

MCP Gateway family, scan of 2026-10-12. Owner: github/gh-aw-mcpg (Upstream — tracked only).

Image (pinned) Status Crit High Med Low Negl Unk Rejected licenses
ghcr.io/github/gh-aw-mcpg:v0.4.30@sha256:ab5a436a1490438db473e4e3d4c973cb1d75e3cb233fb08b73d31b42d7d18fba upstream 10 88 37 15 0 16 0

Counts are raw scanner rows. Order: Critical, High, Medium, Low, Unknown. Format: [severity] ID: package@installed (fix: fixed versions). License status: clean.

Details

Findings: gh-aw-mcpg v0.4.30 
[Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[Critical] CVE-2026-75803: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[Critical] GO-2026-6604: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[Critical] GO-2026-6612: golang.org/x/net@v0.56.0 (fix: 0.60.0)
[Critical] GO-2026-6612: golang.org/x/net@v0.59.0 (fix: 0.60.0)
[Critical] GO-2026-6612: stdlib@go1.26.3 (fix: 1.26.9)
[Critical] GO-2026-6612: stdlib@go1.26.4 (fix: 1.26.9)
[High] CVE-2026-103111: pcre2@10.47-r1 (fix: 10.49-r0)
[High] CVE-2026-14456: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-14456: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-14457: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-14457: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-17106: docker-cli@29.5.3-r0
[High] CVE-2026-18798: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-18798: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-54873: libcrypto3@3.5.7-r0
[High] CVE-2026-54873: libssl3@3.5.7-r0
[High] CVE-2026-54874: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-54874: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63072: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63072: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63075: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63075: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63076: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-63076: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[High] CVE-2026-72897: libcrypto3@3.5.7-r0
[High] CVE-2026-72897: libssl3@3.5.7-r0
[High] CVE-2026-76642: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-76642: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-78408: libblkid@2.42.1-r0 (fix: 2.42.3-r1)
[High] CVE-2026-78408: libmount@2.42.1-r0 (fix: 2.42.3-r1)
[High] CVE-2026-78409: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-78409: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-78410: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-78410: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[High] CVE-2026-84042: crun@1.28-r0 (fix: 1.30.1-r0)
[High] CVE-2026-84782: libcrypto3@3.5.7-r0
[High] CVE-2026-84782: libssl3@3.5.7-r0
[High] CVE-2026-84784: libcrypto3@3.5.7-r0
[High] CVE-2026-84784: libssl3@3.5.7-r0
[High] CVE-2026-85091: zlib@1.3.2-r0 (fix: 1.3.2-r1)
[High] CVE-2026-86145: pcre2@10.47-r1 (fix: 10.48-r0)
[High] CVE-2026-89157: pcre2@10.47-r1 (fix: 10.48-r0)
[High] CVE-2026-89161: pcre2@10.47-r1 (fix: 10.48-r0)
[High] CVE-2026-92543: docker-cli@29.5.3-r0 (fix: 29.8.2-r0)
[High] GHSA-2v4p-qf9q-27wj: google.golang.org/grpc@v1.81.1 (fix: 1.82.2)
[High] GHSA-f5mr-q85p-6hh6: github.com/sigstore/fulcio@v1.8.5 (fix: 1.8.6)
[High] GHSA-hfg8-hc9c-6c3h: github.com/moby/go-archive@v0.2.0 (fix: 0.3.0)
[High] GHSA-hrxh-6v49-42gf: google.golang.org/grpc@v1.81.1 (fix: 1.82.1)
[High] GHSA-vp52-pcj8-j9qc: google.golang.org/grpc@v1.81.1 (fix: 1.83.1)
[High] GO-2026-4970: stdlib@go1.26.4 (fix: 1.25.12, 1.26.5, 1.27.0-rc.2)
[High] GO-2026-5026: stdlib@go1.26.3 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-5026: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-5037: stdlib@go1.26.3 (fix: 1.25.11, 1.26.4)
[High] GO-2026-5942: stdlib@go1.26.3 (fix: 1.26.6, 1.27.0-rc.3)
[High] GO-2026-5942: stdlib@go1.26.4 (fix: 1.26.6, 1.27.0-rc.3)
[High] GO-2026-5970: golang.org/x/text@v0.38.0 (fix: 0.39.0)
[High] GO-2026-5972: stdlib@go1.26.3 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-5972: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-6089: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-6090: stdlib@go1.26.3 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-6090: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[High] GO-2026-6354: golang.org/x/crypto@v0.53.0 (fix: 0.56.0)
[High] GO-2026-6355: golang.org/x/crypto@v0.53.0 (fix: 0.56.0)
[High] GO-2026-6603: golang.org/x/net@v0.56.0 (fix: 0.60.0)
[High] GO-2026-6603: golang.org/x/net@v0.59.0 (fix: 0.60.0)
[High] GO-2026-6603: stdlib@go1.26.3 (fix: 1.26.9)
[High] GO-2026-6603: stdlib@go1.26.4 (fix: 1.26.9)
[High] GO-2026-6605: stdlib@go1.26.3 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6605: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6607: stdlib@go1.26.3 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6607: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6608: stdlib@go1.26.3 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6608: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6609: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6610: stdlib@go1.26.3 (fix: 1.26.9)
[High] GO-2026-6610: stdlib@go1.26.4 (fix: 1.26.9)
[High] GO-2026-6611: golang.org/x/net@v0.56.0 (fix: 0.60.0)
[High] GO-2026-6611: golang.org/x/net@v0.59.0 (fix: 0.60.0)
[High] GO-2026-6611: stdlib@go1.26.3 (fix: 1.26.9)
[High] GO-2026-6611: stdlib@go1.26.4 (fix: 1.26.9)
[High] GO-2026-6613: stdlib@go1.26.3 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6613: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r31
[Medium] CVE-2025-60876: busybox@1.37.0-r31
[Medium] CVE-2025-60876: ssl_client@1.37.0-r31
[Medium] CVE-2026-27456: libblkid@2.42.1-r0 (fix: 2.41.4-r0, 2.42.3-r0)
[Medium] CVE-2026-27456: libmount@2.42.1-r0 (fix: 2.41.4-r0, 2.42.3-r0)
[Medium] CVE-2026-35189: libcrypto3@3.5.7-r0
[Medium] CVE-2026-35189: libssl3@3.5.7-r0
[Medium] CVE-2026-42772: libcrypto3@3.5.7-r0
[Medium] CVE-2026-42772: libssl3@3.5.7-r0
[Medium] CVE-2026-53493: docker-cli@29.5.3-r0 (fix: 29.8.2-r0)
[Medium] CVE-2026-63074: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
[Medium] CVE-2026-63074: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
[Medium] CVE-2026-75804: libcrypto3@3.5.7-r0
[Medium] CVE-2026-75804: libssl3@3.5.7-r0
[Medium] CVE-2026-75805: libcrypto3@3.5.7-r0
[Medium] CVE-2026-75805: libssl3@3.5.7-r0
[Medium] CVE-2026-75806: libcrypto3@3.5.7-r0
[Medium] CVE-2026-75806: libssl3@3.5.7-r0
[Medium] CVE-2026-88264: crun@1.28-r0 (fix: 1.30.1-r0)
[Medium] CVE-2026-88265: crun@1.28-r0 (fix: 1.30.1-r0)
[Medium] CVE-2026-89156: pcre2@10.47-r1 (fix: 10.48-r0)
[Medium] CVE-2026-89158: pcre2@10.47-r1 (fix: 10.48-r0)
[Medium] CVE-2026-89160: pcre2@10.47-r1 (fix: 10.48-r0)
[Medium] CVE-2026-92542: docker-cli@29.5.3-r0 (fix: 29.8.2-r0)
[Medium] GHSA-7236-3392-c5c6: github.com/moby/buildkit@v0.30.0 (fix: 0.31.1)
[Medium] GHSA-mjcv-p78q-w5fw: github.com/moby/sys/user@v0.4.0 (fix: 0.4.1)
[Medium] GHSA-xjvp-4fhw-gc47: github.com/opencontainers/runc@v1.4.2 (fix: 1.4.3)
[Medium] GO-2026-5039: stdlib@go1.26.3 (fix: 1.25.11, 1.26.4)
[Medium] GO-2026-5856: stdlib@go1.26.3 (fix: 1.25.12, 1.26.5, 1.27.0-rc.2)
[Medium] GO-2026-5856: stdlib@go1.26.4 (fix: 1.25.12, 1.26.5, 1.27.0-rc.2)
[Medium] GO-2026-6091: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[Medium] GO-2026-6218: stdlib@go1.26.3 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[Medium] GO-2026-6218: stdlib@go1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
[Low] CVE-2022-3219: gnupg-dirmngr@2.4.9-r1
[Low] CVE-2022-3219: gnupg-gpgconf@2.4.9-r1
[Low] CVE-2022-3219: gnupg-keyboxd@2.4.9-r1
[Low] CVE-2022-3219: gpg-agent@2.4.9-r1
[Low] CVE-2022-3219: gpg@2.4.9-r1
[Low] CVE-2022-3219: gpgsm@2.4.9-r1
[Low] CVE-2026-35191: libcrypto3@3.5.7-r0
[Low] CVE-2026-35191: libssl3@3.5.7-r0
[Low] CVE-2026-54872: libcrypto3@3.5.7-r0
[Low] CVE-2026-54872: libssl3@3.5.7-r0
[Low] CVE-2026-54875: libcrypto3@3.5.7-r0
[Low] CVE-2026-54875: libssl3@3.5.7-r0
[Low] CVE-2026-77696: libcrypto3@3.5.7-r0
[Low] CVE-2026-77696: libssl3@3.5.7-r0
[Low] CVE-2026-89162: pcre2@10.47-r1 (fix: 10.48-r0)
[Unknown] CVE-2026-53612: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] CVE-2026-53612: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] CVE-2026-53613: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] CVE-2026-53613: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] CVE-2026-53614: libblkid@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] CVE-2026-53614: libmount@2.42.1-r0 (fix: 2.42.3-r0)
[Unknown] GO-2026-5932: golang.org/x/crypto@v0.53.0
[Unknown] GO-2026-6599: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[Unknown] GO-2026-6600: stdlib@go1.26.4 (fix: 1.26.9, 1.27.2)
[Unknown] GO-2026-6617: golang.org/x/net@v0.56.0 (fix: 0.60.0)
[Unknown] GO-2026-6617: golang.org/x/net@v0.59.0 (fix: 0.60.0)
[Unknown] GO-2026-6617: stdlib@go1.26.3 (fix: 1.26.9)
[Unknown] GO-2026-6617: stdlib@go1.26.4 (fix: 1.26.9)

Remediation and SLA

  • Cadence: Critical findings are remediated or explicitly risk-accepted within 7 days; High within 30 days; every scanned image is rebuilt on a refreshed base image at least weekly.
  • Default step: the daily gh aw compile --force-refresh-container-pins run opens a pin-refresh PR once the owner publishes a fixed image. No local code-fix PR is requested: the build config for these images is not in github/gh-aw.
  • Fixed package versions in the details identify what the upstream rebuild must contain. No fixed image tag/digest is known yet and none is invented here.
  • Exception (rows with no fix listed): responsible project = owner named above; advisory = scanner URL for the CVE/GHSA/GO id; next review = 2026-10-19; status = tracked, not risk-accepted (no maintainer approval recorded).
  • Every finding is Upstream — tracked only. License rows need a maintainer policy decision (allow-list or upstream change).

Index: #52657

Generated by 🛡️ Daily Container Image Security Scan · copilot · auto · 156.9 AIC · ⌖ 0.792 AIC · ⊞ 8.5K · ◷

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

cookieIssue Monster Loves Cookies!security

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions