THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-qg2g-g9w3-m5h8 (high) — ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

[GHSA] GHSA-qg2g-g9w3-m5h8 (high) — ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

highgithub_advisoriesPublished 2026-09-18

GHSA-qg2g-g9w3-m5h8 Severity: high CVE: CVE-2026-58197

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

## Summary

A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services via `host.docker.internal`. This includes the ToolHive API itself, other ToolHi

Indicators of compromise

CVE-2026-58197cve
http://host.docker.internal:50444/mcpurl
http://host.docker.internal:64965/mcpurl
https://host.docker.internal:6443/versionurl
http://host.docker.internal:11434/api/tagsurl
docker.iodomain

Original source: https://github.com/advisories/GHSA-qg2g-g9w3-m5h8