CVE-2026-58196
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
ToolHive prior to 0.31.0 has a vulnerability in remote authentication where the client trusts the MCP server for authentication discovery destinations, allowing a malicious server to issue GET requests to internal services (link-local, RFC1918, cloud metadata) outside the server's container. This can lead to data exfiltration or privilege escalation.
Risk Assessment
The organization may be exposed to leakage of sensitive data from internal services, including cloud metadata credentials, potentially leading to full infrastructure compromise.
Recommendation
Upgrade ToolHive to version 0.31.0 or later and restrict access to internal IP addresses for MCP clients.
Other vulnerabilities in ToolHive
See all- CVE-2026-58197High
In ToolHive prior to CLI 0.30.1 and Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This is fixed in CLI 0.30.1 and Studio 0.38.0.
- CVE-2026-54450Low
ToolHive prior to 0.29.1 has a flaw in networking.IsPrivateIP (pkg/networking/utilities.go) that omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed, enabling blind probing of internal TCP/TLS reachability on a host behind a NAT64/DNS64 gateway.
Original NVD description (English source)
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can place a resource_metadata URL in WWW-Authenticate for ParseWWWAuthenticate to extract, after which FetchResourceMetadata, OIDC issuer discovery, and well-known discovery can issue GET requests to link-local, RFC1918, or other internal services outside the server's container. The user connects to a server that the user intends to use, but the server controls the internal destination; this path does not depend on the separate NAT64 guard omission because the affected clients did not invoke IsPrivateIP, and it differs from the DCR resolver path that already refused redirects. The demonstrated primitive reaches internal-only HTTP services and reachability or error oracles, and can retrieve AWS metadata credentials where IMDSv1 accepts an unauthenticated GET, while IMDSv2 and GCP metadata prerequisites are not satisfied by the demonstrated request. This vulnerability is fixed in 0.31.0.