[awf] security: gh-aw-node image contains vulnerable packages (OpenSSL, musl)

Firewall Issue Dispatcher · issue · closed

Filter2mode:review mode:live
All recorded Export JSON
github-actions[bot]

published Jul 28, 2026, 1:30 AM · updated Jul 29, 2026, 4:23 PM

Problem

A final-image scan of artifacts selected by gh-aw v0.82.14 found vulnerable packages in the gh-aw-owned gh-aw-node image (ghcr.io/github/gh-aw-node@sha256:529d02eb...). Key findings: libcrypto3/libssl3 3.5.6-r0 (fix: 3.5.7+) and musl 1.2.6-r2 (fix pending). Additionally, gh-aw-mcpg v0.4.3 remains affected — updating from v0.4.1 to v0.4.3 did not resolve MCP gateway findings.

Context

Original report: github/gh-aw#47396

Root Cause

The gh-aw-node base image (Alpine-based) is pinned to a digest that includes outdated versions of OpenSSL and musl. Release cadence does not automatically pull updated Alpine packages.

Proposed Solution

In the gh-aw-node Dockerfile, upgrade to Alpine 3.22+ or explicitly install libcrypto3>=3.5.7 and libssl3>=3.5.7 via apk add --upgrade. Add a Dependabot or Renovate rule to auto-PR base image digest bumps. Pin gh-aw-mcpg to a version with confirmed clean scan results once the component repository publishes one.

Generated by Firewall Issue Dispatcher · sonnet46 · 33 AIC · ⊞ 6.4K ·