CVE-2026-54450

2 advisories.

Go/github.com/stacklok/toolhive CVE-2026-54450: low, EPSS 0.33%

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway

Action: Upgrade github.com/stacklok/toolhive to 0.29.1 or later.

go get github.com/stacklok/toolhive@v0.29.1

Affected

introduced	fixed	last affected
0	0.29.1	-

Fixed versions

0.29.1

Sources

CVE-2026-54450 · published 2026-07-15T21:51:03Z · modified 2026-07-21T19:19:19.599729878Z · JSON

Go/github.com/stacklok/toolhive CVE-2026-54450: unknown, EPSS 0.33%

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

Action: Upgrade github.com/stacklok/toolhive to 0.29.1 or later.

go get github.com/stacklok/toolhive@v0.29.1

Affected

introduced	fixed	last affected
0	0.29.1	-

Fixed versions

0.29.1

Sources

CVE-2026-54450 · published 2026-07-17T19:42:05Z · modified 2026-07-21T19:15:35.721639050Z · JSON