{"data":{"id":"65976c52-74b0-4f3d-9101-548e9cf88afa","title":"GHSA-qg2g-g9w3-m5h8: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement","summary":"ToolHive's containerized MCP servers (which are Docker containers running AI tools) can reach host services through `host.docker.internal` (a special hostname that points to the host machine from inside a container) when using the default insecure network settings, allowing a compromised server to attack other services on the host without breaking out of the container. This is especially dangerous because ToolHive's MCP endpoints and other MCP servers are unauthenticated (don't require login), so an attacker can call their tools directly.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-qg2g-g9w3-m5h8","publishedAt":"2026-09-18T17:16:02.000Z","cveId":"CVE-2026-58197","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["github.com/stacklok/toolhive@< 0.30.1 (fixed: 0.30.1)"],"affectedVendors":[],"affectedVendorsRaw":["ToolHive","MCP","Ollama"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-09-18T17:16:02.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}