PT-2026-60392 · Toolhive · Toolhive
CVE-2026-58196
·
Published
2026-07-15
·
Updated
2026-07-30
CVSS v3.1
4.7
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ToolHive versions 0.x through 0.29.3
Description
ToolHive contains a Server-Side Request Forgery (SSRF) issue during remote MCP server authentication discovery. The application issues outbound HTTP requests to URLs controlled by a remote MCP server without implementing private-IP or loopback guards and without restricting redirects. This allows a malicious or compromised remote MCP server to force the ToolHive host process to fetch arbitrary internal URLs, such as cloud instance metadata, effectively bypassing the container isolation designed to sandbox MCP servers.
The issue occurs because the discovery clients do not utilize the existing
IsPrivateIP guard or ValidateRemoteURL function. Specifically, the FetchResourceMetadata function and the OIDC issuer discovery path are affected. An attacker can provide a resource metadata URL in a WWW-Authenticate header that passes initial HTTPS checks but redirects to an internal address (e.g., 169.254.169.254).API Endpoints:
.well-known/openid-configuration.well-known/oauth-authorization-server
Vulnerable Parameters or Variables:
resource metadata
Function Names:
FetchResourceMetadata()DetectAuthenticationFromServer()ParseWWWAuthenticate()
Recommendations
For versions 0.x through 0.29.3, implement the following fixes:
- Set
CheckRedirectto reject cross-host or scheme-downgrade redirects in the discovery clients. - Wrap
DialContextwith theIsPrivateIPguard forFetchResourceMetadata,DetectAuthenticationFromServer, and the issuer-discovery client. - Ensure redirect targets are re-validated to prevent HTTPS URLs from redirecting to internal HTTP addresses.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Toolhive