{"vulnerability": "cve-2026-58197", "sightings": [{"uuid": "8a10257e-f670-4f9f-8bb0-154f57024f0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58197", "type": "seen", "source": "https://gist.github.com/alon710/50855ff55b1aa73627deda9900094dcd", "content": "# CVE-2026-58197: CVE-2026-58197: Host Escape and Lateral Movement via Insecure Container Network Defaults in ToolHive\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-58197\n\n## Summary\nA high-severity access control vulnerability in ToolHive CLI before v0.30.1 and ToolHive Studio before v0.38.0 allows local containerized MCP servers to bypass network isolation. This enables malicious workloads to establish TCP/IP connections to administrative and control plane endpoints exposed on the host loopback interface.\n\n## TL;DR\nToolHive failed to isolate local containerized MCP servers by default, allowing malicious containers to bypass isolation via host.docker.internal and access unauthenticated host-local APIs and databases.\n\n## Technical Details\n\n- **CWE ID**: CWE-284 / CWE-306\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Base Score**: 8.8 (High)\n- **Exploit Status**: No Public Exploit\n- **CISA KEV Status**: Not Listed\n- **Impact**: Privileged Host Access / Remote Code Execution via lateral APIs\n\n## Affected Systems\n\n- ToolHive CLI deployments running containerized MCP servers\n- ToolHive Studio desktop and server installations managing local containers\n- **toolhive**: < 0.30.1 (Fixed in: `v0.30.1`)\n- **toolhive-studio**: < 0.38.0 (Fixed in: `v0.38.0`)\n\n## Mitigation\n\n- Immediately upgrade ToolHive CLI to v0.30.1 or higher.\n- Immediately upgrade ToolHive Studio to v0.38.0 or higher.\n- Explicitly enforce the --isolate-network=true parameter in all legacy CLI run commands.\n- Implement host-level firewall policies to block Docker bridge networks from connecting to unauthenticated ports on localhost.\n\n**Remediation Steps:**\n1. Verify the current version of ToolHive CLI by running 'thv --version'.\n2. Download and apply the updated CLI binary (v0.30.1 or greater) from the official repository releases page.\n3. Update ToolHive Studio desktop application to v0.38.0 or greater.\n4. Inspect active containers using 'docker inspect' to ensure that network modes do not permit mapping to host loopback interfaces.\n5. As a temporary workaround, execute all CLI workloads with explicit flags: 'thv run --isolate-network=true '.\n\n## References\n\n- [GitHub Security Advisory GHSA-qg2g-g9w3-m5h8](https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8)\n- [NVD - CVE-2026-58197 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-58197)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-58197)\n- [ToolHive CLI v0.30.1 Release Notes](https://github.com/stacklok/toolhive/releases/tag/v0.30.1)\n- [ToolHive Studio v0.38.0 Release Notes](https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-58197) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T16:32:14.410443Z"}]}