T08 · Insecure Dependencies
Error
- Location
scripts/run_mcp_atlassian.sh:26- Finding
Mutable Third-Party Container Image Receives Jira Credentials
- Content
View full analysis
- Remediation
View remediation
' docker run --rm -i \ -e JIRA_URL="$JIRA_URL" \ -e JIRA_USERNAME="$JIRA_USERNAME" \ -e JIRA_API_TOKEN="$JIRA_API_TOKEN" \ "$IMAGE" ``` 2. **Verify image provenance and signatures** before approving a digest. Where supported, enforce signature verification with a tool such as Cosign and accept only images signed by an explicitly trusted publisher identity. 3. **Establish a controlled dependency-update process** in which digest changes are reviewed, scanned for known vulnerabilities, tested, and committed as auditable project changes. 4. **Use a dedicated least-privilege Jira account and token** limited to the projects and operations required by the MCP integration. Avoid administrator credentials and rotate the token regularly. 5. **Restrict container capabilities and privileges** where compatible with the application, for example by enabling a read-only filesystem, dropping Linux capabilities, preventing privilege escalation, and applying resource limits. 6. **Restrict outbound network access** to the required Atlassian endpoints where the deployment environment supports network policies or an allowlisted proxy. This reduces the ability of a compromised image to exfiltrate credentials. 7. **Update `SKILL.md`** to use the same verified digest as the script and document the image-verification and token-rotation procedures. ]]>