CVE-2026-58197: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
A containerized MCP server running with the default network permission profile (insecure_allow_all: true) can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host’s localhost. Combined with the unauthenticated ToolHive API and MCP proxy endpoints, this enables a compromised or malicious MCP server to perform lateral movement without any container escape.
References
- github.com/advisories/GHSA-qg2g-g9w3-m5h8
- github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- github.com/stacklok/toolhive-studio/pull/2469
- github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- github.com/stacklok/toolhive/pull/5583
- github.com/stacklok/toolhive/releases/tag/v0.30.1
- github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- nvd.nist.gov/vuln/detail/CVE-2026-58197
Code Behaviors & Features
Detect and mitigate CVE-2026-58197 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →