MCP server image unpinned

ID

mcp-server-image-unpinned

Severity

high (catalogue Medium; platform severity model has no 'medium')

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM03:2025 — Supply Chain

OWASP ASI

ASI04:2026

OWASP AST

AST07:2026 (secondary AST02:2026)

Family

LLM03 — Supply Chain

Red-team vectors

Sandbox Escape / RCE

Tags

ai_security

Description

An MCP-server / agent container image is referenced by a mutable tag (latest, a branch-like tag such as main/dev, or no tag at all) with no digest pin, in an mcp.json, docker-compose, Helm values file, or agent YAML. A registry compromise (or a routine tag move) then silently changes what the agent runs — the container equivalent of an unpinned dependency.

A conventional immutable version tag (:1.2.3) is not flagged; only floating/mutable tags and missing tags are.

Examples

services:
  mcp:
    image: ghcr.io/acme/mcp-server:latest   (1)
1 Mutable latest tag, no digest — flagged.

The same reference pinned by digest (ghcr.io/acme/mcp-server@sha256:…​) produces no finding.

Mitigation / Fix

  • Pin the image by immutable digest (image@sha256:…​).

  • Verify the digest against a trusted source in your supply chain.