Executive brief
ToolHive, a tool for running isolated AI server components, contains a security flaw that allows a malicious server to bypass its protective sandbox. When a user connects to a compromised or malicious remote server, that server can trick the ToolHive host application into making unauthorized requests to internal company systems or cloud metadata services. This could lead to the exposure of sensitive internal data or cloud credentials, defeating the primary security isolation ToolHive is intended to provide.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in ToolHive's authentication discovery clients within `pkg/auth/discovery` and `pkg/auth/remote`. The discovery process issues outbound HTTP requests to URLs provided by remote MCP servers (via `WWW-Authenticate` headers or OIDC discovery) without validating against private IP ranges or restricting redirects. Because this discovery logic executes on the host side rather than within the isolated per-server container, a malicious server can use HTTP 302 redirects to force the ToolHive host to fetch internal resources, such as AWS IMDSv1 credentials at 169.254.169.254. The vulnerability stems from maintainers explicitly suppressing security linters (gosec G704) based on a false assumption of trust for the remote endpoint. The issue is addressed in version 0.31.0 by implementing redirect validation and private IP guards.
Affected products
- stacklok ToolHive < 0.31.0
Timeline
- 2026-06-12: disclosed: Vulnerability identified at commit 05f11b53
- 2026-06-26: advisory: Initial GitHub Advisory published
- 2026-07-15: patched: Final advisory update and patch confirmation for v0.31.0