github.com/stacklok/toolhive vulnerabilities (Go)

3 vulnerabilities.

• github.com/stacklok/toolhive Go ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement CVE-2026-58197 Fix available 8.8 HighSeptember 18, 2026
• github.com/stacklok/toolhive Go ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) CVE-2026-58196 Fix available 4.7 MediumJuly 15, 2026
• github.com/stacklok/toolhive Go ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway CVE-2026-54450 Fix available 2.9 LowJuly 15, 2026