MCP gateway v0.4.3 image contains vulnerable runtime packages

[loganrosen]

Summary

A final-image scan of the MCP gateway image selected by gh-aw v0.82.14 found vulnerable Alpine and Go runtime packages.

The original findings were detected from the published v0.4.1 image contents, not solely from repository manifests. An independent follow-up scan confirmed that v0.4.3 remains affected, although its finding set differs.

Originally affected artifact

ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32

v0.4.3 verification

Verified on July 22, 2026 using Syft v1.49.0, Grype v0.116.0, and a Grype database built on July 22, 2026.

Index:       sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83
linux/amd64: sha256:a257bf876a4ce12745a84427c1ff4aedd029ccc4547bc1d11a6f313eb1ab777a
linux/arm64: sha256:3774c57e8aacc2c6dcc65fee605c5a2e66d405c010916533c1fef18f52c12d93

Both platform scans produced the same 11 matches.

Original findings

Finding	v0.4.3 result	Attribution
CVE-2026-40200	Not affected	The image contains Alpine 3.24.1 musl 1.2.6-r2, which Alpine records as the fixed package. Current Grype data reports no musl match.
GO-2026-4970	Affected	/usr/bin/docker, stdlib go1.26.3; fixed in Go 1.26.5
GO-2026-5037	Affected	/usr/bin/docker, stdlib go1.26.3; fixed in Go 1.26.4
GO-2026-5038	Affected	/usr/bin/docker, stdlib go1.26.3; fixed in Go 1.26.4

The awmg binary uses stdlib go1.25.12, which is fixed for GO-2026-4970, GO-2026-5037, and GO-2026-5038. Those three findings originate exclusively from the installed Docker CLI in both platform images.

Additional v0.4.3 findings

Finding	Severity reported by Grype	Component and path	Fixed version reported
CVE-2025-60876	Medium	busybox, busybox-binsh, and ssl_client 1.37.0-r31; /lib/apk/db/installed	No fix listed
GHSA-hrxh-6v49-42gf	High	google.golang.org/grpc v1.81.1; /app/awmg	v1.82.1
GO-2026-5039	Medium	stdlib go1.26.3; /usr/bin/docker	Go 1.26.4
GO-2026-5856	Medium	stdlib go1.26.3; /usr/bin/docker	Go 1.26.5
GO-2026-5942	Unknown	golang.org/x/net v0.55.0; /app/awmg	v0.56.0
GO-2026-5970	Unknown	golang.org/x/text v0.37.0; /app/awmg	v0.39.0

The three CVE-2025-60876 rows are matches against packages from the same BusyBox source package, not three independent vulnerabilities.

Reproduction

AMD64='ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:a257bf876a4ce12745a84427c1ff4aedd029ccc4547bc1d11a6f313eb1ab777a'
ARM64='ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3774c57e8aacc2c6dcc65fee605c5a2e66d405c010916533c1fef18f52c12d93'

syft --platform linux/amd64 "$AMD64" -o syft-json=amd64-sbom.json
grype sbom:amd64-sbom.json

syft --platform linux/arm64 "$ARM64" -o syft-json=arm64-sbom.json
grype sbom:arm64-sbom.json

Completion criteria

• Resolve and record the immutable linux/amd64 and linux/arm64 digests for v0.4.3.
• Generate a final-image SBOM and vulnerability report for each platform digest.
• Attribute the original Go standard-library findings to a specific binary.
• Confirm whether v0.4.3 remains affected.
• Review runtime applicability for each remaining finding.
• Publish a supported release that no longer contains affected versions, or document why each remaining finding does not apply to the executable runtime.