CVE-2026-54450

Name of the Vulnerable Software and Affected Versions ToolHive versions prior to 0.29.1

Description ToolHive contains a Server-Side Request Forgery (SSRF) issue where the private IP guard in pkg/networking/utilities.go fails to recognize IPv6 NAT64 address ranges, specifically the well-known prefix 64:ff9b::/96 and the local-use prefix 64:ff9b:1::/48. In environments utilizing a NAT64/DNS64 gateway, such as IPv6-only Kubernetes clusters, an attacker can bypass SSRF protections by using NAT64-encoded addresses to target internal or link-local resources, including the cloud metadata address 169.254.169.254.

The primary attacker-controlled entry point is the Client ID Metadata Document (CIMD) fetcher in pkg/oauthproto/cimd/fetch.go, where an external OAuth client can provide a malicious URL via the client id parameter. Other affected components sharing the IsPrivateIP() function include the protectedDialerControl HTTP clients (used for registry, OIDC discovery, and token introspection) and the skills git-clone host check in pkg/skills/gitresolver.

Due to constraints such as mandatory HTTPS and TLS certificate verification, the impact is limited to a blind internal-reachability probe (internal network reconnaissance) rather than the theft of metadata credentials.

Recommendations Update ToolHive to a version later than 0.29.0. As a temporary mitigation, restrict the use of the client id parameter in the OAuth authorization server to trusted domains only. Restrict access to the protectedDialerControl HTTP clients and the pkg/skills/gitresolver module to minimize the risk of internal probing.