github.com/stacklok/toolhive
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement | github.com/stacklok/toolhive | Go | High | Fix reported | |
| ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway | github.com/stacklok/toolhive | Go | Low | Fix reported | |
| ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) | github.com/stacklok/toolhive | Go | Low | Fix reported |