GO-2026-6526Published
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-58197 · Microsoft / collected KEV context
cve-program · CVE-2026-58197
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
euvd · EUVD-2026-83167
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
nvd · CVE-2026-58197
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
osv · GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
osv · GO-2026-6526
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
- https://github.com/stacklok/toolhive/pull/5583
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
- https://github.com/stacklok/toolhive-studio/pull/2469
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.