CVE-2026-58197ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
Updated under an hour ago ()
Does this affect you?
It affects stacklok toolhive and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This access can expose data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio additionally sends network_isolation as false and overrides the backend's secure isolation default. This issue is fixed in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-284, CWE-306
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
stacklok toolhive stacklok:toolhive (from the name) | before 0.30.1 | CNA record |
stacklok toolhive-studio stacklok:toolhive_studio (from the name) | before 0.38.0 | CNA record |
References
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8x-refsource-confirm
- https://github.com/stacklok/toolhive-studio/pull/2469x-refsource-misc
- https://github.com/stacklok/toolhive/pull/5583x-refsource-misc
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0x-refsource-misc
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712x-refsource-misc
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0x-refsource-misc
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.