CVE-2026-58197: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
A containerized MCP server running with the default network permission profile (insecure_allow_all: true) can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host’s localhost. Combined with the unauthenticated ToolHive API and MCP proxy endpoints, this enables a compromised or malicious MCP server to perform lateral movement without any container escape.
References
- github.com/advisories/GHSA-qg2g-g9w3-m5h8
- github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- github.com/stacklok/toolhive-studio/pull/2469
- github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- github.com/stacklok/toolhive/pull/5583
- github.com/stacklok/toolhive/releases/tag/v0.30.1
- github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- nvd.nist.gov/vuln/detail/CVE-2026-58197
Code Behaviors & Features
Detect and mitigate CVE-2026-58197 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →