stacklok toolhive vulnerabilities
4 published CVEs name stacklok toolhive among the affected products.
- 4Published CVEs4 of them scored
- 3Last 12 monthspublished in the last year
- 0Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-58197
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
stacklok · toolhive
High8.8 - CVE-2026-58196
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
stacklok · toolhive
Medium4.7 - CVE-2026-54450
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
stacklok · toolhive
Low2.9 - CVE-2025-47274
ToolHive stores secrets in the state store with no encryption
stacklok · toolhive
Low2.4