Skip to content
Fencer Vulns
high 8.8

CVE-2026-58197 json

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

published 2026-09-18 51 d ago modified 2026-09-28 41 d ago also GHSA-qg2g-g9w3-m5h8 , GO-2026-6526 , EUVD-2026-83167

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This access can expose data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio additionally sends network_isolation as false and overrides the backend's secure isolation default. This issue is fixed in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0.

Patch / fix

  • go github.com/stacklok/toolhive 0.30.1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
51 d ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/stacklok/toolhive
<0.30.1
0.30.1

Affected products

  • stacklok toolhive
  • stacklok toolhive-studio

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.