Skip to content
Stacklok vulnerabilities
Newest
-
stacklok toolhive, toolhive-studio +1 more
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
Fix available
8.8 High
-
stacklok toolhive
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
CVE-2026-58196
Fix available
4.7 Medium
-
stacklok toolhive
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
CVE-2026-54450
Fix available
2.9 Low
-
stacklok toolhive
ToolHive stores secrets in the state store with no encryption
CVE-2025-47274
2.4 Low
-
mindersec minder
Denial of service from maliciously configured Git repository in Minder
CVE-2024-37904
Fix available
5.7 Medium
-
mindersec minder
Denial of service of Minder Server from maliciously crafted GitHub attestations
CVE-2024-35238
Fix available
5.3 Medium
-
mindersec minder
Stacklok Minder vulnerable to denial of service from maliciously crafted templates
CVE-2024-35194
Fix available
5.3 Medium
-
mindersec minder
Denial of service of Minder Server with attacker-controlled REST endpoint
CVE-2024-35185
Fix available
5.3 Medium
-
mindersec minder
Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests
CVE-2024-34084
Fix available
7.5 High
-
mindersec minder
Minder GetRepositoryByName data leak
CVE-2024-31455
Fix available
4.3 Medium
-
lfprojects minder
`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user
CVE-2024-27916
Fix available
7.1 High
-
lfprojects minder
Minder trusts client-provided mapping from repo name to upstream ID
CVE-2024-27093
Fix available
4.6 Medium