Skip to content
Heist/ feed
HighFix available

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Type: advisorySource: OSV1 source record

## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services via `host.docker.internal`. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host's localhost. Combined with the unauthenticated ToolHive API and MCP proxy endpoints, this enables a compromised or malicious MCP server to perform lateral movement without any container escape. ## Severity **High** — This bypasses the container isolation model that is ToolHive's core security value proposition. ## Reproduction All tests performed from inside the `filesystem` MCP container (`docker.io/mcp/filesystem:latest`), started with default settings via `thv run filesystem -- /tmp`. ### 1. Container can reach the ToolHive control plane MCP endpoint ```bash $ docker exec wget -qO- \ --header="Content-Type: application/json" \ --header="Accept: application/json" \ --post-data='{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"evil-mcp","version":"1.0"}},"id":1}' \ http://host.docker.internal:50444/mcp ``` **Result:** Full MCP handshake succeeds: ```json {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"logging":{},"tools":{}},"serverInfo":{"name":"toolhive-mcp","version":"v0.9.3"}}} ``` ### 2. Container can connect to another MCP server's proxy and call its tools ```bash $

Announced Source revision 1
Original source ↗

GHSA-qg2g-g9w3-m5h8

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-qg2g-g9w3-m5h8

github.com/stacklok/toolhive

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.30.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.30.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/stacklok/toolhive",
      "purl": "pkg:golang/github.com/stacklok/toolhive",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qg2g-g9w3-m5h8/GHSA-qg2g-g9w3-m5h8.json"
    }
  }
]
Related CVEs
CVE-2026-58197

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Event
#23388 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement