What’s Vulnerable › Products

stacklok toolhive vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your stacklok toolhive version is affected

Latest stacklok toolhive vulnerabilities

• CVE-2026-58197 — ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement (CVSS 8.8)
• CVE-2026-58196 — ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (CVSS 4.7)
• CVE-2026-54450 — ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway (CVSS 2.9)
• CVE-2025-47274 — ToolHive stores secrets in the state store with no encryption (CVSS 2.4)