CVE-2026-54450

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.

• CWE-918

• https://github.com/stacklok/toolhive/commit/26912af453d2040787983dbc9ab93a9019ec0468
• https://github.com/stacklok/toolhive/releases/tag/v0.29.1
• https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54446NetLicensing MCP Server is a natural-language interface that…8.1
• CVE-2026-54447garminconnect is a Python 3 API wrapper for Garmin Connect t…8.4
• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5
• CVE-2026-54449LangBot is a global IM bot platform designed for LLMs. In ve…8.8
• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-54451Elixir protobuf is a pure Elixir implementation of Google Pr…8.2
• CVE-2026-54452safeurl is a server-side request forgery protection library.…6.3
• CVE-2026-54457TensorZero is an open-source LLMOps platform that unifies an…7.7
• CVE-2026-54458WWBN AVideo is an open source video platform. Versions prior…9.6
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1
• CVE-2026-54460OpenReception's appointment booking software provides an end…9.8