Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/stacklok/toolhive

3 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 high, 1 medium, 1 low
Registry
pkg.go.dev

Advisories 3

  • ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

    Affected: fixed in 0.30.1.

  • CVE-2026-58196Medium 4.7

    ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

    Affected: fixed in 0.31.0.

  • ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway

    Affected: fixed in 0.29.1.