CVE-2026-58197 Details
Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This access can expose data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio additionally sends network_isolation as false and overrides the backend's secure isolation default. This issue is fixed in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0.
A vulnerability exists in ToolHive CLI versions prior to 0.30.1 and ToolHive Studio versions prior to 0.38.0. In these versions, locally run Model Context Protocol (MCP) server containers operate without proper network isolation, allowing them to access host services via 'host.docker.internal'. This issue is exacerbated by the fact that ToolHive API and MCP proxy endpoints do not require authentication. As a result, a malicious or compromised MCP server could exploit this lack of isolation to reach host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane, potentially leading to unauthorized access to data and logs, manipulation of process or workload states, and disruption of services.
Users can update to ToolHive CLI version 0.30.1 or ToolHive Studio version 0.38.0, both of which include the necessary network isolation by default. Instructions for downloading these versions are available on the ToolHive GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712 | [email protected] | Source CodeVendor |
| https://github.com/stacklok/toolhive/pull/5583 | [email protected] | Issue TrackingVendor |
| https://github.com/stacklok/toolhive/releases/tag/v0.30.1 | [email protected] | Release NotesVendor |
| https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0 | [email protected] | Source CodeVendor |
| https://github.com/stacklok/toolhive-studio/pull/2469 | [email protected] | Issue TrackingVendor |
| https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Stacklok ToolHive CLI | < 0.30.1 (semver) |
CPE
Remediation
| |
| Stacklok ToolHive Studio | < 0.38.0 (semver) |
CPE
Remediation
| |
| Stacklok ToolHive | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | New CVE Received | [email protected] |
| Sep 18, 2026 | CVE Modified | CISA-ADP |