Start for Free
go

github.com/stacklok/toolhive

View on go registry
5 Total advisories
5 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/stacklok/toolhive is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 8.8
Go

CVE-2026-58197

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
UNKNOWN
Go

CVE-2026-54450

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
MEDIUM 4.7
Go

CVE-2026-58196

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
UNKNOWN
Go

CVE-2026-54450

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive
UNKNOWN
Go

CVE-2026-58196

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes