---
id: CVE-2026-58197
title: >-
  ToolHive is a utility designed to simplify the deployment and management of
  Model Context Protocol servers
summary: >-
  ToolHive is a utility designed to simplify the deployment and management of
  Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive
  Studio 0.38.0, locally run MCP server containers use the default network
  permission pro…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-284
  - CWE-306
vendor: stacklok
product: github.com/stacklok/toolhive
affected:
  - github.com/stacklok/toolhive < 0.30.1
patched:
  - github.com/stacklok/toolhive 0.30.1
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T17:16:57.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58197'
references:
  - url: >-
      https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
    label: security-advisories@github.com
  - url: 'https://github.com/stacklok/toolhive-studio/pull/2469'
    label: security-advisories@github.com
  - url: 'https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
    label: security-advisories@github.com
  - url: 'https://github.com/stacklok/toolhive/pull/5583'
    label: security-advisories@github.com
  - url: 'https://github.com/stacklok/toolhive/releases/tag/v0.30.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
    label: security-advisories@github.com
  - url: >-
      https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-qg2g-g9w3-m5h8'
  - url: 'https://github.com/stacklok/toolhive'
tags:
  - nvd
  - ghsa
  - go
  - cve.org
  - exploit-available
  - osv
aliases:
  - GHSA-qg2g-g9w3-m5h8
ecosystem: go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T16:50:57.044209Z'
ingestedAt: '2026-09-18T16:45:41.405Z'
epss: 0.0036
epssPercentile: 0.29737
---

## Overview

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This access can expose data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio additionally sends network_isolation as false and overrides the backend's secure isolation default. This issue is fixed in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-58197)

Affected packages:

- `github.com/stacklok/toolhive < 0.30.1`

Patched in:

- `github.com/stacklok/toolhive 0.30.1`

Source: https://github.com/advisories/GHSA-qg2g-g9w3-m5h8