CVE-2026-58197

Name of the Vulnerable Software and Affected Versions ToolHive CLI versions prior to 0.30.1 ToolHive Studio versions prior to 0.38.0

Description Locally run Model Context Protocol (MCP) server containers use a default network permission profile that lacks network isolation. This allows containers to access host.docker.internal via the Docker gateway. Because the ToolHive API and MCP proxy endpoints are reachable without authentication, a malicious or compromised MCP server can perform lateral movement to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without needing to escape the container. This can lead to data and log exposure, the invocation of sibling MCP tools, alteration of process or workload states, and service disruption. ToolHive Studio further exacerbates this by sending network isolation as false, overriding the backend's secure isolation default. The issue is rooted in the use of insecure allow all: true as a default and the lack of authentication on API and proxy endpoints.

Recommendations Update ToolHive CLI to version 0.30.1. Update ToolHive Studio to version 0.38.0.