🚨 Security: Critical or high vulnerabilities in mcp-neo4j-aura-manager container
Open
Nobody has claimed this yet.
critical
grype
high
security
- Dominant language
- Go
- Stars
- 8
- Forks
- 7
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 62
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/uvx/mcp-neo4j-aura-manager:0.4.8 - Critical vulnerabilities: 1
- High vulnerabilities: 1
Details
See the Security tab for full details.
Critical Vulnerabilities
- GHSA-vv7q-7jx5-f767 in
fastmcp@2.14.7: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
High Vulnerabilities
- GHSA-rww4-4w9c-7733 in
fastmcp@2.14.7: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Automated security scan from periodic-security-scan workflow
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the mcp-neo4j-aura-manager:0.4.8 image and the periodic-security-scan workflow, then review the linked Security tab findings for fastmcp@2.14.7. Trace where this dependency enters the container build and determine the supported remediation. Done means both listed vulnerabilities are resolved and the build workflow no longer blocks publishing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 48/100