Repository navigation
[container-image-scan] GitHub MCP Server CVE burn-down #65794
Description
Overview
GitHub MCP Server family, scan of 2026-10-12. Owner: github/github-mcp-server (Upstream — tracked only).
| Image (pinned) | Status | Crit | High | Med | Low | Negl | Unk | Rejected licenses |
|---|---|---|---|---|---|---|---|---|
ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6 |
upstream | 2 | 12 | 14 | 5 | 8 | 3 | 0 |
Counts are raw scanner rows. Order: Critical, High, Medium, Low, Unknown, Negligible. Format: [severity] ID: package@installed (fix: fixed versions). License status: clean.
Details
Findings: github-mcp-server v1.12.2
[Critical] CVE-2026-75803: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[Critical] GO-2026-6612: stdlib@go1.27.1 (fix: 1.27.2)
[High] CVE-2026-19499: libc6@2.36-9+deb12u14
[High] CVE-2026-54874: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[High] CVE-2026-63072: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[High] CVE-2026-63076: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[High] CVE-2026-84782: libssl3@3.0.20-1~deb12u2
[High] GO-2026-6603: stdlib@go1.27.1 (fix: 1.27.2)
[High] GO-2026-6605: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6607: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6608: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[High] GO-2026-6610: stdlib@go1.27.1 (fix: 1.27.2)
[High] GO-2026-6611: stdlib@go1.27.1 (fix: 1.27.2)
[High] GO-2026-6613: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[Medium] CVE-2026-18374: libc6@2.36-9+deb12u14
[Medium] CVE-2026-19542: libc6@2.36-9+deb12u14
[Medium] CVE-2026-35189: libssl3@3.0.20-1~deb12u2
[Medium] CVE-2026-42767: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[Medium] CVE-2026-6238: libc6@2.36-9+deb12u14
[Medium] CVE-2026-63074: libssl3@3.0.20-1~deb12u2 (fix: 3.0.22-1~deb12u1)
[Medium] CVE-2026-6791: libc6@2.36-9+deb12u14
[Medium] CVE-2026-75805: libssl3@3.0.20-1~deb12u2
[Medium] CVE-2026-75806: libssl3@3.0.20-1~deb12u2
[Medium] CVE-2026-77117: libc6@2.36-9+deb12u14
[Medium] CVE-2026-80489: libc6@2.36-9+deb12u14
[Medium] CVE-2026-8674: libc6@2.36-9+deb12u14
[Medium] CVE-2026-86805: libc6@2.36-9+deb12u14
[Medium] CVE-2026-89092: libc6@2.36-9+deb12u14
[Low] CVE-2026-54872: libssl3@3.0.20-1~deb12u2
[Low] CVE-2026-6368: libc6@2.36-9+deb12u14
[Low] CVE-2026-77696: libssl3@3.0.20-1~deb12u2
[Low] CVE-2026-95818: libc6@2.36-9+deb12u14
[Low] CVE-2026-97399: libc6@2.36-9+deb12u14
[Unknown] GO-2026-6599: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[Unknown] GO-2026-6600: stdlib@go1.27.1 (fix: 1.26.9, 1.27.2)
[Unknown] GO-2026-6617: stdlib@go1.27.1 (fix: 1.27.2)
Negligible (IDs only): CVE-2010-4756 CVE-2018-20796 CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024 CVE-2019-1010025 CVE-2019-9192 CVE-2025-27587
Remediation and SLA
- Cadence: Critical findings are remediated or explicitly risk-accepted within 7 days; High within 30 days; every scanned image is rebuilt on a refreshed base image at least weekly.
- Default step: the daily
gh aw compile --force-refresh-container-pinsrun opens a pin-refresh PR once the owner publishes a fixed image. No local code-fix PR is requested: the build config for these images is not ingithub/gh-aw. - Fixed package versions in the details identify what the upstream rebuild must contain. No fixed image tag/digest is known yet and none is invented here.
- Exception (rows with no fix listed): responsible project = owner named above; advisory = scanner URL for the CVE/GHSA/GO id; next review = 2026-10-19; status = tracked, not risk-accepted (no maintainer approval recorded).
- Every finding is Upstream — tracked only. License rows need a maintainer policy decision (allow-list or upstream change).
Index: #52657
Generated by 🛡️ Daily Container Image Security Scan · copilot · auto · 156.9 AIC · ⌖ 0.792 AIC · ⊞ 8.5K · ◷
Activity