ToolHive is a utility for deploying and managing Model Context Protocol (MCP) servers. Before versions CLI 0.30.1 and Studio 0.38.0, MCP server containers run locally with default network permissions lacking isolation, permitting access to host.docker.internal and unauthenticated access to ToolHive API and MCP proxy endpoints. A malicious or compromised MCP server container can leverage this to contact host-local services, other MCP proxies, or the control plane without escaping the container. This improper access control (CWE-284) and lack of authentication (CWE-306) can expose sensitive data and logs, allow invocation of sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio also overrides the backend's secure isolation default by sending network_isolation as false. The issue is resolved in ToolHive CLI 0.30.1 and Studio 0.38.0.

The vulnerability allows a malicious or compromised MCP server container to access host-local services and internal ToolHive endpoints without authentication, potentially exposing sensitive data and logs, enabling unauthorized invocation of sibling MCP tools, altering process or workload states, and disrupting services. This can lead to significant confidentiality, integrity, and availability impacts within affected environments.

This vulnerability is fixed in ToolHive CLI version 0.30.1 and ToolHive Studio version 0.38.0. Users should upgrade to these versions or later to ensure network isolation is properly enforced and unauthenticated access to internal endpoints is prevented.