Unrated

SSRF in ToolHive remote MCP server authentication discovery

IdentifiersCVE-2026-58196CWE-918

CVE-2026-58196 is a server-side request forgery vulnerability in ToolHive's remote MCP server authentication discovery logic. A malicious or compromised remote MCP server can cause the ToolHive host process to perform outbound HTTP GET requests to attacker-chosen destinations, including internal and link-local addresses, undermining the expected container isolation boundary. The vulnerable behavior includes following redirects without adequate destination validation and lacking sufficient address filtering during resource metadata retrieval, authentication detection, and issuer discovery flows. As a result, attacker-influenced discovery responses can steer the host into requesting internal-only resources and cloud instance metadata endpoints.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker controlling a remote MCP server to use the ToolHive host as a proxy for arbitrary internal HTTP requests. This can expose internal services that are not otherwise reachable externally, leak response content from sensitive endpoints, and provide network reachability and error-based reconnaissance against private address space. In cloud environments, if instance metadata access is available and protections such as IMDSv2 enforcement are absent, exploitation can disclose cloud IAM credentials from the metadata service. The vulnerability therefore enables internal network probing, sensitive information disclosure, and potential follow-on compromise using harvested credentials.

Mitigation

If you can’t patch tonight, do this now.

Until an upgrade can be applied, do not use remote MCP server authentication discovery against untrusted or externally controlled remote MCP servers. Restrict egress from the ToolHive host process to prevent access to link-local, private, and metadata service address ranges, including cloud instance metadata endpoints. Network controls should also prevent redirect-based access from the host to sensitive internal HTTP services.

Remediation

Patch, then assume compromise.

Upgrade ToolHive to version 0.31.0 or later. The recommended fix includes hardening the discovery clients to reject unsafe redirects, prevent scheme downgrades and cross-host redirects where inappropriate, and apply private-address filtering consistently through the existing private-IP validation logic in resource metadata fetching, authentication detection, and issuer discovery code paths.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

StacklokToolhiveapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity