Disclosed vulnerability
CVE-2026-58197: ToolHive MCP server containers on the default network profile can reach host services, sibling MCP proxies and the control plane
AIR-2026-0262 AIR record · 2026-09-stacklok-toolhive-default-network-lateral-movement
From the supporting source
A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services via `host.docker.internal`.github.com
The record
Disclosed
2026-09-18
Vendor
Stacklok
Product
ToolHive CLI and ToolHive Studio
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — default container network profile lets an MCP server reach host and control plane; no model action in the chain
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious or compromised mcp server
Impact type
Lateral movement, Unauthorized tool invocation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ToolHive CLI < 0.30.1 and ToolHive Studio < 0.38.0 running MCP servers with the default network permission profile
Capability abused
Defense & remediation
Recorded defense
container isolation (default network permission profile allows all outbound traffic)
Guardrail kinds
Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
ToolHive CLI 0.30.1 (Studio 0.38.0 per the OSV record)
Taxonomy & references
Curator notes
GitHub advisory GHSA-qg2g-g9w3-m5h8, published 2026-09-18, rated High (CVSS 8.8 per the OSV record). The advisory's reproduction runs from inside a stock filesystem MCP container: it completes an MCP handshake with the ToolHive control-plane endpoint, lists and calls tools on a second MCP server's proxy, and reaches other host-local services such as a Kubernetes API and a local model server. No container escape is needed; the weakness is that the ToolHive API and proxy endpoints require no authentication and the default profile permits all outbound traffic. The advisory is a researcher-style reproduction; no exploitation against a real user is reported.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-58197: ToolHive MCP server containers on the default network profile can reach host services, sibling MCP proxies and the control plane". AIR, AIR-2026-0262. https://agentincident.vercel.app/i/AIR-2026-0262/ (accessed 2026-10-19).