Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-58196— ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

Quick assessment

Affected
stacklok toolhive
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ToolHive 是一款旨在简化模型上下文协议（MCP）服务器部署与管理的工具。在 0.31.0 版本之前， 中的 会调用 中的 。该函数中的主机侧 HTTP 客户端信任由远程服务器控制的认证发现目标，且在不限制主机或方案（scheme）的情况下跟随重定向，并未能一致地阻断私有地址。 一个恶意或已被攻陷的远程 MCP 服务器可以在 响应头中嵌入 URL，以便被 函数提取。随后， 、OIDC 发行方发现（OIDC issuer discovery）以及已知名称（well-known）发现流程可能向容器外部的链路本地（

CVSS 4.7 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-58196

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
Source: CVE Program / CVE List V5
Vulnerability Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can place a resource_metadata URL in WWW-Authenticate for ParseWWWAuthenticate to extract, after which FetchResourceMetadata, OIDC issuer discovery, and well-known discovery can issue GET requests to link-local, RFC1918, or other internal services outside the server's container. The user connects to a server that the user intends to use, but the server controls the internal destination; this path does not depend on the separate NAT64 guard omission because the affected clients did not invoke IsPrivateIP, and it differs from the DCR resolver path that already refused redirects. The demonstrated primitive reaches internal-only HTTP services and reachability or error oracles, and can retrieve AWS metadata credentials where IMDSv1 accepts an unauthenticated GET, while IMDSv2 and GCP metadata prerequisites are not satisfied by the demonstrated request. This vulnerability is fixed in 0.31.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
stacklok toolhive < 0.31.0 -

II. Public POCs for CVE-2026-58196

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-58196

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-58196 (1)

Vendor Pages for CVE-2026-58196 (1)

IV. Related Vulnerabilities

Same product: toolhive
Same vendor: stacklok
Same weakness: CWE-918

V. Comments for CVE-2026-58196

No comments yet

Leave a comment