CVE-2026-58196— ToolHive 远程MCP服务器认证发现SSRF漏洞
一分钟漏洞结论
影响对象
stacklok toolhive
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
ToolHive 是一款旨在简化模型上下文协议（MCP）服务器部署与管理的工具。在 0.31.0 版本之前， 中的 会调用 中的 。该函数中的主机侧 HTTP 客户端信任由远程服务器控制的认证发现目标，且在不限制主机或方案（scheme）的情况下跟随重定向，并未能一致地阻断私有地址。 一个恶意或已被攻陷的远程 MCP 服务器可以在 响应头中嵌入 URL，以便被 函数提取。随后， 、OIDC 发行方发现（OIDC issuer discovery）以及已知名称（well-known）发现流程可能向容器外部的链路本地（
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-58196 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
来源: CVE Program / CVE List V5
Vulnerability Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can place a resource_metadata URL in WWW-Authenticate for ParseWWWAuthenticate to extract, after which FetchResourceMetadata, OIDC issuer discovery, and well-known discovery can issue GET requests to link-local, RFC1918, or other internal services outside the server's container. The user connects to a server that the user intends to use, but the server controls the internal destination; this path does not depend on the separate NAT64 guard omission because the affected clients did not invoke IsPrivateIP, and it differs from the DCR resolver path that already refused redirects. The demonstrated primitive reaches internal-only HTTP services and reachability or error oracles, and can retrieve AWS metadata credentials where IMDSv1 accepts an unauthenticated GET, while IMDSv2 and GCP metadata prerequisites are not satisfied by the demonstrated request. This vulnerability is fixed in 0.31.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-58196 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-58196 的情报信息
请登录查看更多情报信息。
CVE-2026-58196 厂商安全公告 (1)
CVE-2026-58196 厂商页面 (1)
-
🔗 Release v0.31.0 · stacklok/toolhive · GitHub x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2026-58196
暂无评论