GHSA-qg2g-g9w3-m5h8: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Summary

A containerized MCP server running under the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services through `host.docker.internal`, including the ToolHive API, other ToolHive-managed MCP server proxies, and other localhost services. Because the ToolHive API and MCP proxy endpoints are unauthenticated, a compromised or malicious MCP server can move laterally without a container escape. The source rates the severity High.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online