[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-07-27 Weekly Report

[github-actions[bot]]

Executive Summary

Lookback: 2026-07-20 → 2026-07-27 | Commits: 328 (106 security-signal) | Open scanning alerts: 4 | Open security issues: 45

The repository is operationally active with strong SDLC controls. The highest-priority unresolved risks are: (1) unpatched Critical/High CVEs in deployed container images with no upstream fix yet, and (2) open Sighthound CWE-78 command-injection findings that require formal review/dismissal against existing #nosec justifications. No secret exposure, no evidence of supply-chain compromise.

---

Asset Graph Summary (Recent-Change Scoped)

Segment	Changed	Risk Signals	Tier Hypothesis
pkg/cli/ — CLI commands	✅ Yes	Sighthound CWE-78 ×141, Semgrep GraphQL ×2, recent secret argv fix	B — Open With Conditions
Container images (github-mcp-server, gh-aw-node)	✅ Yes (digests bumped)	Critical/High CVEs (libc6), no upstream fix	C — Restricted Pending Review
actions/setup/js/ — MCP gateway / safe-outputs	✅ Yes	GH_AW_INPUT_* env forwarding, auth token scope, ESLint hardening	B — Open With Conditions
.github/workflows/ — CI/CD	✅ Yes	AWF v0.27.42/MCP v0.4.6 bumps, WIF auth for Gemini, action-pin fix	B — Open With Conditions
scripts/ensure-docs-slide-pdf.js	No	CodeQL network-to-file (medium, open since Jun 2026)	B — Open With Conditions
Safe-output sanitisation (pkg/)	✅ Yes	Angle-bracket autolink fix, IPv6 edge cases patched	A — Open Safe (patched)

---

Tier Classification Table

Area	Tier	Rationale
Container images with unpatched Critical CVEs	C	Critical libc6 CVE-2026-5450 in ghcr.io/github/github-mcp-server:v1.7.0 and gh-aw-node; no upstream fix yet; runtime exposure
pkg/cli/ CWE-78 exec.Command findings	B	141 Sighthound findings but code includes #nosec G204 with written justifications; requires formal review and either dismissal or remediation
Semgrep GraphQL injection alerts #651/#652	B	Query actually uses variables (-f login=+owner via gh CLI), not raw interpolation; fmt.Sprintf only in nearby logging lines; likely false positive requiring dismissal
scripts/ensure-docs-slide-pdf.js network-to-file	B	CodeQL medium alert open since June 2026; review and dismiss or fix
MCP gateway / auth token scope	B	Recently hardened; env forwarding deliberate; no active exploit signal
Safe-output sanitisation	A	Patched in this window; tests expanded

---

Control Verification

Domain	Evidence	Gap	Confidence
Ownership	CODEOWNERS: @dsyme @eaftan @pelikhan @krzysztof-cieslak	All changed packages have named owners	High
SDLC	Semgrep daily scan, CodeQL configured, Sighthound scans, Zizmor workflow linting (.github/zizmor.yml), PR review active	141 Sighthound CWE-78 findings open without formal dismissal	Medium
Dependency	Dependabot configured (Go, npm ×3, pip), container image digests pinned, action SHA pinning fixed in #48291	Container images have unpatchable upstream CVEs	Medium
Secret exposure	Secret scanning (0 open alerts), secret argv→stdin migration completed (#48318), include write boundary hardening	No gaps identified	High
Runtime observability	Daily container scans, sighthound scans, bot-detection workflow, OpenTelemetry traces referenced in docs	No dedicated runtime anomaly monitoring identified	Medium
Recovery	Rollback via re-deploy, upgrade workflow (upgrade_command.go), audit trails in workflow runs	Container image CVEs have no available fix version — recovery blocked on upstream	Low (for containers)

---

Risk Scoring Table

Area	Exposure Amp	Patchability	Detectability	Op. Fragility	Ownership Conf.	Overall	Tier
Container images: Critical CVE-2026-5450 (libc6)	4	5	3	3	4	3.8	C
CWE-78 exec.Command pkg/cli/	3	2	2	2	5	2.8	B
Semgrep GraphQL alerts #651/#652	2	2	2	1	5	2.4	B
network-to-file scripts/ (CodeQL)	2	2	2	1	4	2.2	B
MCP gateway env/auth	3	1	3	3	5	3.0	B

Scores 1–5 (5 = highest risk). Overall = mean.

---

Remediation Queue

#	Finding	Tier	SLA	Action
1	Critical CVE-2026-5450 in github-mcp-server & gh-aw-node (libc6)	C	High (14 days)	Monitor Debian security tracker for libc6 fix; rebuild base images when fix published; consider minimal distroless base
2	Sighthound CWE-78 (141 findings) — review #nosec coverage	B	Medium (30 days)	Audit each flagged function against existing #nosec G204 justifications; dismiss with documented rationale or fix
3	Semgrep GraphQL injection #651/#652	B	Medium (30 days)	Verify Semgrep false positive (query uses variables); dismiss with justification in code scanning alert
4	CodeQL network-to-file scripts/ensure-docs-slide-pdf.js:149	B	Low (60 days)	Review script; if intentional, dismiss with justification; if not needed, remove

---

Exception Register

Finding	Threat Hypothesis	Exploit Acceleration	Op. Weakness	Mitigation Plan	Expiry
Container libc6 CVEs (no fix)	Remote code execution via libc6 memory corruption in MCP server	Moderate — public CVE, no PoC observed	Container rebuild blocked on upstream Debian patch	Monitor Debian tracker weekly; restrict network exposure of MCP server	2026-09-27

---

Operational Metrics Baseline

Metric	Value	Notes
MTTR proxy	~1–3 days	Recent security fixes (#48318, #48169, #48291) merged within the same or next day
Ownership coverage	4 named owners (100% of repo)	@dsyme @eaftan @pelikhan @krzysztof-cieslak
Unsupported dependency ratio	~2 container images with CVEs, no upstream fix	libc6 in Debian Bookworm; pinned scanner versions
Exception aging	0 active exceptions (proposed 1 new)	Container libc6 exception proposed above
Exposure without recovery	Container images: Critical CVE, no fix available	Mitigated by network isolation; escalation path: rebuild when Debian patches

---

Next Actions

1. [High] Track libc6 CVE-2026-5450 fix in Debian Bookworm; rebuild github-mcp-server and gh-aw-node when available — see Issue #aw_cve_libc6
2. [Medium] Dismiss or fix Sighthound CWE-78 findings in pkg/cli/ with documented #nosec rationale audit — see Issue #aw_cwe78_audit
3. [Medium] Dismiss Semgrep GraphQL alerts #651/[Custom Engine Test] Test Issue Created by Custom Engine #652 as false positives (query uses variables)
4. [Low] Review CodeQL network-to-file alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #636 in scripts/ensure-docs-slide-pdf.js

References:

• §30283298593
• §30242057128 — Sighthound scan
• §30190925397 — Container image scan

Generated by UK AI Operational Resilience · sonnet46 · 83.5 AIC · ⌖ 7.39 AIC · ⊞ 5.3K · ◷

• expires on Jul 30, 2026, 8:16 AM UTC-08:00