GHSA-qg2g-g9w3-m5h8: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
Summary
ToolHive's containerized MCP servers (which are Docker containers running AI tools) can reach host services through `host.docker.internal` (a special hostname that points to the host machine from inside a container) when using the default insecure network settings, allowing a compromised server to attack other services on the host without breaking out of the container. This is especially dangerous because ToolHive's MCP endpoints and other MCP servers are unauthenticated (don't require login), so an attacker can call their tools directly.
Vulnerability Details
EPSS: 0.0%
Yes
September 18, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-qg2g-g9w3-m5h8
First tracked: September 18, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 85%