stacklok toolhive-studio vulnerabilities

Latest stacklok toolhive-studio CVEs

Newest publication first

1. CVE-2026-58197 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

   Published 2026-09-18

   High·CVSS 8.8 EPSS 0.37%

   ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.