Go/github.com/stacklok/toolhive CVE-2026-58197: high 8.8, EPSS 0.37%
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
Action: Upgrade github.com/stacklok/toolhive to 0.30.1 or later.
go get github.com/stacklok/toolhive@v0.30.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.30.1 | - |
Fixed versions
| 0.30.1 |
Sources
- osv: GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
CVE-2026-58197 · published · modified · JSON