Skip to content

[aw] Daily Container Image Security Scan reported incomplete result #60381

Open
Open
[aw] Daily Container Image Security Scan reported incomplete result#60381
Labels
agentic-workflows

Description

@github-actions
github-actions
bot
opened on Sep 12, 2026

Workflow Failure

Workflow: Daily Container Image Security Scan
Branch: main
Run: https://github.com/github/gh-aw/actions/runs/34675740977

Warning

Task Could Not Be Completed: The agent reported that the task could not be performed due to an infrastructure or tool failure.

Reasons:

  • Accidentally used the single-use update_issue call on a test/placeholder body before the real report was ready; the per-run update_issue limit (1) was then exhausted, so issue [container-image-scan] Container CVE burn-down #52657 currently shows a placeholder 'test' body instead of the compiled scan summary. The correctly compiled full report body (summary table + per-image collapsible details, ordered Critical->High->Medium->Low->Unknown/Negligible, upstream vs vendored classification per the task rules) is included in 'details' below and must be applied to issue [container-image-scan] Container CVE burn-down #52657 on the next run via update_issue.

    Overview

Consolidated Critical/High CVE and license burn-down tracker for the daily container image security scan. Per-image detail issues are not created; all findings are tracked here.

Scan run

Compiled with gh aw compile --force-refresh-container-pins. Workflow run: 34675740977.

Remediation SLA

  • Critical findings are remediated or explicitly risk-accepted within 7 days.
  • High findings are remediated within 30 days.
  • Every scanned image is rebuilt on a refreshed base image at least weekly — this workflow runs gh aw compile --force-refresh-container-pins daily, so a pin-refresh PR is the default remediation step.
  • For upstream images, no local code-fix PR is requested; the daily pin refresh automatically picks up upstream fixes once released. Those findings are labeled "Upstream — tracked only" below.
  • Only ghcr.io/github/gh-aw-node is vendored in this repository (built from /actions/setup/js/Dockerfile.safe-outputs-mcp); it is the only image where a local dependency-bump/config change can land directly.

Summary table (ordered Critical → High → Medium → Low → Unknown/Negligible)

Image Pinned ref Class Critical High Medium Low Unknown Negligible License violations
ghcr.io/github/gh-aw-firewall/squid 0.28.15@sha256:0006cecb Upstream (github/gh-aw-firewall) 10 35 7 0 2 0 11
ghcr.io/github/gh-aw-firewall/api-proxy 0.28.15@sha256:0410a07c Upstream (github/gh-aw-firewall) 4 18 10 0 2 0 1
ghcr.io/github/gh-aw-firewall/cli-proxy 0.28.15@sha256:0f7c2e2b Upstream (github/gh-aw-firewall) 4 18 9 0 2 0 1
ghcr.io/github/gh-aw-mcpg v0.4.20@sha256:980ea7aa Upstream (github/gh-aw-mcpg) 4 48 19 0 7 6 0
node:lts-alpine sha256:50c8e8ca Upstream (Docker Official node; base for gh-aw-node) 4 18 10 0 0 0 0
grafana/mcp-grafana 1.1.0-alpine@sha256:e0eb29cd Upstream (Grafana Labs, 3rd-party) 4 16 3 0 0 0 0
ghcr.io/github/gh-aw-firewall/agent 0.28.15@sha256:9f13ae19 Upstream (github/gh-aw-firewall) 0 4 272 47 0 19 32
ghcr.io/github/gh-aw-node sha256:0daa8971 Vendored (built from Dockerfile in this repo) 2 11 4 0 1 0 0
ghcr.io/github/github-mcp-server v1.12.1@sha256:0ba840c4 Upstream (github/github-mcp-server, 3rd-party build) 1 3 5 1 4 8 0
ghcr.io/xberg-io/xberg latest@sha256:694d7a16 Upstream (kreuzberg-dev/kreuzberg, 3rd-party) 7 96 60 13 9 112 47
ghcr.io/oraios/serena 1.7.0@sha256:6c9459e4 Upstream (oraios/serena) 12 211 166 36 52 623 0

Totals: 52 Critical, 478 High, 565 Medium, 103 Low, 79 Unknown, 762 Negligible findings across 11 scanned images. License policy violations: 92, all on upstream base-layer packages (firewall agent/squid/api-proxy/cli-proxy images and xberg) — no vendored code fix possible here. Only ghcr.io/github/gh-aw-node is vendored in this repository.

Per-image detail

ghcr.io/oraios/serena:1.7.0 — Upstream (oraios/serena) — 12 Critical, 211 High, 166 Medium, 36 Low, 52 Unknown, 623 Negligible

Classification: Upstream — tracked only. Fix must land in oraios/serena; the daily pin refresh will pick up a newer upstream release automatically.

Critical:

  • CVE-2026-63073 — libssl3t64@3.5.6-1deb13u2, openssl@3.5.6-1deb13u2, openssl-provider-legacy@3.5.6-1deb13u2 (fix: 3.5.7-1deb13u2)
  • CVE-2026-19931 — curl@8.14.1-2+deb13u4, libcurl3t64-gnutls@8.14.1-2+deb13u4, libcurl4t64@8.14.1-2+deb13u4 (no fix listed upstream yet)
  • CVE-2026-18924 — curl@8.14.1-2+deb13u4, libcurl3t64-gnutls@8.14.1-2+deb13u4, libcurl4t64@8.14.1-2+deb13u4 (no fix listed upstream yet)
  • CVE-2026-75803 — libssl3t64@3.5.6-1deb13u2, openssl@3.5.6-1deb13u2, openssl-provider-legacy@3.5.6-1deb13u2 (fix: 3.5.7-1deb13u2)

High (top packages; ~50 unique CVEs across 211 findings):

Medium/Low/Unknown/Negligible: 166/36/52/623 additional findings, predominantly in the same base OS packages (openssl, curl, perl, util-linux family) and transitive npm/pip deps bundled by the upstream image; not individually itemized here per SLA — remediated automatically on next upstream base refresh.

ghcr.io/xberg-io/xberg:latest — Upstream (kreuzberg-dev/kreuzberg, 3rd-party) — 7 Critical, 96 High, 60 Medium, 13 Low, 9 Unknown, 112 Negligible, 47 license violations

Classification: Upstream — tracked only. This is the kreuzberg MCP server container (ghcr.io/xberg-io/xberg, referenced from .github/workflows/shared/mcp/kreuzberg.md), built and owned by the kreuzberg-dev/kreuzberg project. Fix must land upstream; pin refresh will pick up a newer release automatically.

Critical:

High (top packages; 96 findings):

License violations (47): all "no licenses found" or copyleft (GPL-2.0/3.0, LGPL) system packages inherited from the Debian base image (e.g. libicu76, debian-archive-keyring, login.defs, libglib2.0-0t64, libpango-1.0-0, tini, etc.) — inherent to the upstream Debian-based build, not addressable in this repo.

Medium/Low/Unknown/Negligible: 60/13/9/112 additional findings in the same base OS package set — remediated automatically on next upstream base refresh.

ghcr.io/github/gh-aw-mcpg:v0.4.20 — Upstream (github/gh-aw-mcpg) — 4 Critical, 48 High, 19 Medium, 7 Unknown, 6 Negligible

Classification: Upstream — tracked only. Owned by github/gh-aw-mcpg; fix must land there. Pin refresh will pick up a newer release automatically.

Critical:

  • CVE-2026-63073 — libcrypto3@3.5.7-r0, libssl3@3.5.7-r0 (fix: 3.5.8-r0)
  • CVE-2026-75803 — libcrypto3@3.5.7-r0, libssl3@3.5.7-r0 (fix: 3.5.8-r0)

High (selected; 48 findings):

  • CVE-2026-18798, -63076, -14457, -14456, -63072, -54874, -63075 — libcrypto3/libssl3@3.5.7-r0 (fix: 3.5.8-r0)
  • CVE-2026-76642, -78409, -78408, -78410 — libblkid@2.42.1-r0, libmount@2.42.1-r0 (fix: 2.42.3-r0/r1)
  • GO-2026-5026 — stdlib@go1.26.3/1.26.4 (fix: 1.25.13, 1.26.6, 1.27.0-rc.3)
  • GO-2026-5037 — stdlib@go1.26.3 (fix: 1.25.11, 1.26.4)
  • GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-5942 — stdlib@go1.26.3/1.26.4 (fix: 1.25.13/1.26.6/1.27.0-rc.3)
  • GO-2026-5970 — golang.org/x/text@v0.38.0 (fix: 0.39.0)
  • GHSA-vp52-pcj8-j9qc — google.golang.org/grpc@v1.81.1 (fix: 1.83.1)
  • GHSA-2v4p-qf9q-27wj — google.golang.org/grpc@v1.81.1/v1.83.1 (fix: 1.82.2/1.83.2)
  • GHSA-hrxh-6v49-42gf — google.golang.org/grpc@v1.81.1 (fix: 1.82.1)
  • GO-2026-6354, GO-2026-6355 — golang.org/x/crypto@v0.53.0 (fix: 0.56.0)
  • CVE-2026-17106 — docker-cli@29.5.3-r0 (no fix listed)
  • GHSA-hfg8-hc9c-6c3h — github.com/moby/go-archive@v0.2.0 (fix: 0.3.0)
  • GO-2026-4970 — stdlib@go1.26.4 (fix: 1.25.12, 1.26.5, 1.27.0-rc.2)
  • GHSA-f5mr-q85p-6hh6 — github.com/sigstore/fulcio@v1.8.5 (fix: 1.8.6)

Medium/Unknown/Negligible: 19/7/6 additional findings, mostly the same alpine/openssl base and remaining transitive Go modules.

ghcr.io/github/gh-aw-firewall/squid:0.28.15 — Upstream (github/gh-aw-firewall) — 10 Critical, 35 High, 7 Medium, 2 Unknown, 11 license violations

Classification: Upstream — tracked only. Owned by github/gh-aw-firewall; fix must land there. Pin refresh will pick up a newer release automatically.

Critical:

  • CVE-2026-63073 — libcrypto3@3.5.7-r0, libssl3@3.5.7-r0, openssl@3.5.7-r0 (fix: 3.5.8-r0)
  • CVE-2026-19931 — curl@8.21.0-r0, libcurl@8.21.0-r0 (fix: 8.22.0-r0)
  • CVE-2026-18924 — curl@8.21.0-r0, libcurl@8.21.0-r0 (fix: 8.22.0-r0)
  • CVE-2026-75803 — libcrypto3@3.5.7-r0, libssl3@3.5.7-r0, openssl@3.5.7-r0 (fix: 3.5.8-r0)

High (35 findings): CVE-2026-18798, -63076, -14457, -14456, -63072, -54874, -63075 (libcrypto3/libssl3/openssl@3.5.7-r0, fix 3.5.8-r0); CVE-2026-80231, -80229, -80255, -13608, -82209, -80230, -82208 (curl/libcurl@8.21.0-r0, fix 8.22.0-r0).

License violations (11): system packages inherited from the Alpine/squid base image, e.g. xz-libs (0BSD/GPL/LGPL mix), bind-libs/bind-tools (MPL-2.0), squid itself (GPL-2.0-or-later), logrotate, libcom_err, acl-libs, libltdl, mii-tool, keyutils-libs, userspace-rcu — inherent to the upstream base, not addressable here.

Medium/Unknown: 7/2 additional findings in the same package set.

ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15 — Upstream (github/gh-aw-firewall) — 4 Critical, 18 High, 10 Medium, 2 Unknown, 1 license violation

Classification: Upstream — tracked only. Owned by github/gh-aw-firewall.

Critical: CVE-2026-19931, CVE-2026-18924 — curl@8.21.0-r0, libcurl@8.21.0-r0 (fix: 8.22.0-r0)

High (18): CVE-2026-80231, -80229, -80255, -13608, -82209, -80230, -82208 — curl/libcurl@8.21.0-r0 (fix: 8.22.0-r0); GHSA-rgw5-rvv9-x895 — brace-expansion@5.0.7 (fix: 5.0.9); GHSA-mh99-v99m-4gvg — brace-expansion@5.0.7 (fix: 5.0.8); GHSA-r292-9mhp-454m — tar@7.5.19 (fix: 7.5.21); GHSA-mwp4-54f8-5fhr — ip-address@10.2.0 (fix: 10.3.1)

License violations (1): awf-api-proxy@1.0.0 — no licenses found (internal firewall package metadata; owned by github/gh-aw-firewall).

ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.15 — Upstream (github/gh-aw-firewall) — 4 Critical, 18 High, 9 Medium, 2 Unknown, 1 license violation

Classification: Upstream — tracked only. Owned by github/gh-aw-firewall. Same curl/brace-expansion/tar/ip-address findings as api-proxy above (shared base image).

License violations (1): awf-cli-proxy@1.0.0 — no licenses found.

node:lts-alpine — Upstream (Docker Official node image) — 4 Critical, 18 High, 10 Medium

Classification: Upstream — tracked only. This is the Docker Official node image and also the base layer for the vendored ghcr.io/github/gh-aw-node image below.

Critical: CVE-2026-63073, CVE-2026-75803 — libcrypto3/libssl3@3.5.7-r0 (fix: 3.5.8-r0)

High (18): CVE-2026-18798, -63076, -14457, -14456, -63072, -54874, -63075 (libcrypto3/libssl3@3.5.7-r0, fix 3.5.8-r0); GHSA-rgw5-rvv9-x895 (brace-expansion@5.0.7, fix 5.0.9); GHSA-mh99-v99m-4gvg (fix 5.0.8); GHSA-r292-9mhp-454m (tar@7.5.19, fix 7.5.21); GHSA-mwp4-54f8-5fhr (ip-address@10.2.0, fix 10.3.1)

Medium (10): CVE-2026-63074 (libcrypto3/libssl3, fix 3.5.8-r0); GHSA-22jq-vg5j-6vgg, GHSA-4xrf-jv44-h6hh (ip-address@10.2.0); CVE-2025-60876 (busybox family); GHSA-v3r7-h72x-cjcm, GHSA-m8rv-5g2x-5cg5, GHSA-8xcm-r25x-g524 (undici@6.27.0, fix 6.28.0)

grafana/mcp-grafana:1.1.0-alpine — Upstream (Grafana Labs, 3rd-party) — 4 Critical, 16 High, 3 Medium

Classification: Upstream — tracked only. Owned by Grafana Labs. Pin refresh will pick up a newer upstream release automatically.

Critical: CVE-2026-63073, CVE-2026-75803 — libcrypto3/libssl3@3.5.7-r0 (fix: 3.5.8-r0)

High (16): CVE-2026-18798, -63076, -14457, -14456, -63072, -54874, -63075 (libcrypto3/libssl3, fix 3.5.8-r0); GHSA-vp52-pcj8-j9qc, GHSA-2v4p-qf9q-27wj — google.golang.org/grpc@v1.80.0 (fix: 1.82.2–1.83.1)

Medium (3): CVE-2026-63074 (libcrypto3/libssl3); GHSA-qc2q-p7wx-3px3 (grpc@v1.80.0, fix 1.83.1)

ghcr.io/github/gh-aw-firewall/agent:0.28.15 — Upstream (github/gh-aw-firewall) — 0 Critical, 4 High, 272 Medium, 47 Low, 19 Negligible, 32 license violations

Classification: Upstream — tracked only. Owned by github/gh-aw-firewall.

High (4): GHSA-rgw5-rvv9-x895 — brace-expansion@5.0.7 (fix: 5.0.9); GHSA-mh99-v99m-4gvg — brace-expansion@5.0.7 (fix: 5.0.8); GHSA-r292-9mhp-454m — tar@7.5.19 (fix: 7.5.21); GHSA-mwp4-54f8-5fhr — ip-address@10.2.0 (fix: 10.3.1)

Medium (272) / Low (47) / Negligible (19): predominantly bind9-libs (CVE-2023-50387, -50868, CVE-2024-12705, -11187, -1975, -1737, -0760, -4408, CVE-2025-8677, -40778, CVE-2026-5946, -1519, -3039, -5950, -3104), libpython3.10*/python3.10* (CVE-2026-11940, -7210, -15308), libcurl3-gnutls/libcurl4/curl (CVE-2026-19931), libglib2.0-0 (CVE-2026-58015), plus low/negligible findings in php8.1-*, libjpeg-turbo8, libcairo2, libzstd1, libdbus-1-3, git/git-man, libpcre2-8-0.

License violations (32): headless-browser/graphics dependency stack bundled in the firewall agent image (e.g. libgraphite2-3, libatk1.0-0, fonts-liberation, libasound2*, libavahi-*, libgbm1, libatspi2.0-0, libdbus-1-3, libpango*, libatk-bridge2.0-0, libxrandr2, libxkbcommon0, libdatrie1, libnspr4, libxfixes3, libcups2, libfribidi0, libxcomposite1, libthai0/libthai-data, libxshmfence1, xkb-data, libnss3, fontconfig, libxi6, libxdamage1, libavahi-client3) — copyleft/mixed licenses inherent to the upstream Chromium/Playwright-style base, not addressable in this repo.

ghcr.io/github/gh-aw-node — Vendored (built from Dockerfile in this repo) — 2 Critical, 11 High, 4 Medium, 1 Unknown

Classification: Vendored — built from /actions/setup/js/Dockerfile.safe-outputs-mcp in this repository, based on node:lts-alpine. A base-image bump (already refreshed daily via --force-refresh-container-pins) is the primary remediation path here; all findings mirror the node:lts-alpine base above.

Critical: CVE-2026-19931, CVE-2026-18924 — libcurl@8.21.0-r0 (fix: 8.22.0-r0)

High (11): CVE-2026-80231, -80229, -80255, -13608, -82209, -80230, -82208 — libcurl@8.21.0-r0 (fix: 8.22.0-r0); CVE-2026-66046, -76641, -76956, -76957 — libexpat@2.8.3-r0 (fix: 2.8.4-r0)

Medium (4): CVE-2025-60876 — busybox/busybox-binsh/ssl_client@1.37.0-r31; CVE-2026-58055 — nghttp2-libs@1.69.0-r0

Unknown (1): CVE-2026-80256 — curl/libcurl@8.21.0-r0 (fix: 8.22.0-r0)

ghcr.io/github/github-mcp-server:v1.12.1 — Upstream (github/github-mcp-server, 3rd-party build) — 1 Critical, 3 High, 5 Medium, 1 Low, 4 Unknown, 8 Negligible

Classification: Upstream — tracked only. Owned by github/github-mcp-server. Pin refresh will pick up a newer release automatically.

Critical: CVE-2026-75803 — libssl3@3.0.20-1~deb12u2 (no fix listed for this branch yet)

High (3): CVE-2026-63076, CVE-2026-63072, CVE-2026-54874 — libssl3@3.0.20-1~deb12u2

Medium (5): CVE-2026-42767, -63074, -6238, -6791, -18374 — libssl3/libc6@3.0.20-1~deb12u2/2.36-9+deb12u14

Low (1): CVE-2026-6368 — libc6@2.36-9+deb12u14

Unknown (4): CVE-2026-19499, -19542, -77117, -80489 — libc6@2.36-9+deb12u14

Negligible (8): CVE-2018-20796, CVE-2019-1010022/23/24/25, CVE-2010-4756, CVE-2019-9192 (libc6); CVE-2025-27587 (libssl3)

Next actions

  • No local remediation PR needed for upstream images (firewall, gh-aw-mcpg, serena, xberg, github-mcp-server, grafana/mcp-grafana, node:lts-alpine) — the daily pin-refresh workflow is the standing remediation path; escalate to the owning repo if a Critical finding remains unfixed upstream past the 7-day SLA.
  • The only vendored surface, ghcr.io/github/gh-aw-node, tracks its base image (node:lts-alpine) 1:1; no separate code fix is available beyond the base bump already captured by the daily refresh.

This is a structured incompletion signal (report_incomplete), not a real task outcome. Any other safe outputs emitted alongside this signal (e.g., comments) describe the failure state, not a completed review or action.

Warning

Engine Failure: The copilot engine terminated unexpectedly.

Last agent output:

| 3 | 🟡 MEDIUM | 11 images | 565 findings | mostly Upstream |
| 4 | ⚪ LOW | 8 images | 103 findings | mostly Upstream |
| 5 | ⚪ UNKNOWN/NEGLIGIBLE | 10 images | 841 findings | mostly Upstream |
| — | License violations | 5 images | 92 | Upstream base-layer packages |
Only `ghcr.io/github/gh-aw-node` is vendored; everything else (firewall images, gh-aw-mcpg, serena, xberg/kreuzberg, github-mcp-server, grafana/mcp-grafana, node:lts-alpine) is upstream-owned and tracked-only pending daily pin refresh.
**Next action needed:** re-run the workflow (or a maintainer) to apply the corrected body to #52657 via `update_issue`, since this run's single write was already consumed on the placeholder.
Changes    +269 -0
Duration   8m 18s
Tokens     ↑ 10.7m (10.6m cached) • ↓ 41.9k
Resume     copilot --resume=c1b12fa5-9a26-4cfd-8719-97d891b28d92

Action Required

Assign this issue to an agent to debug and fix the issue.

Debug with any coding agent

Use this prompt with any coding agent (GitHub Copilot, Claude, Gemini, etc.):

Debug the agentic workflow failure using https://raw.githubusercontent.com/github/gh-aw/main/debug.md

The failed workflow run is at https://github.com/github/gh-aw/actions/runs/34675740977
Manually invoke the agent

Debug this workflow failure using your favorite Agent CLI and the agentic-workflows prompt.

Tip

Stop reporting this workflow as a failure

To stop a workflow from creating failure issues, set report-failure-as-issue: false in its frontmatter:

safe-outputs:
  report-failure-as-issue: false

Generated from Daily Container Image Security Scan · copilot · 293.7 AIC · ◷

  • expires on Sep 12, 2026, 5:56 PM UTC

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agentic-workflows

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions