TO
Product
toolhive
4
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 1Low 2
Watch
Add toolhive to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58197 | 8.8 | Sep 18 | ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement Affected: < 0.30.1 |
| CVE-2026-58196 | 4.7 | Sep 15 | ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) Affected: < 0.31.0 |
| CVE-2026-54450 | 2.9 | Sep 15 | ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway Affected: < 0.29.1 |
| CVE-2025-47274 | 2.4 | May 12 | ToolHive stores secrets in the state store with no encryption Affected: < 0.0.33 |
Showing 4