{"action":"Upgrade github.com/stacklok/toolhive to 0.30.1 or later.","affected":[{"fixed":"0.30.1","introduced":"0"}],"component":"github.com/stacklok/toolhive","cve_ids":["CVE-2026-58197"],"ecosystem":"Go","epss":0.00372,"exploited":false,"fixed_versions":["0.30.1"],"ghsa_id":"GHSA-qg2g-g9w3-m5h8","id":"tcs_01M5KGV6VRN1D7JB2Q1Z3NQSF4","modified_at":"2026-09-28T17:00:17.156957582Z","published_at":"2026-09-28T16:43:40Z","references":["https://osv.dev/vulnerability/GO-2026-6526","https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8","https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712","https://github.com/stacklok/toolhive/pull/5583","https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0","https://github.com/stacklok/toolhive-studio/pull/2469","https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0","https://github.com/stacklok/toolhive/releases/tag/v0.30.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6526","url":"https://osv.dev/vulnerability/GO-2026-6526"}],"summary":"ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive"}