ToolHive's private IP detection function (IsPrivateIP) omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48 from its private IP block list. As a result, NAT64-encoded IPv6 addresses that map to internal IPv4 addresses (such as 169.254.169.254, the cloud metadata service) are misclassified as public addresses. This allows attacker-controlled URLs, particularly in the OAuth Client ID Metadata Document fetcher, to bypass SSRF protections and cause outbound connections to internal or link-local addresses via a NAT64 gateway. The vulnerability affects multiple components that share the same IP classification logic, except the webhook client. The flaw is due to incomplete IP range checks in the IsPrivateIP function and impacts all versions before 0.29.1.

An attacker controlling the OAuth client_id URL can cause ToolHive to initiate connections to internal or link-local addresses behind a NAT64 gateway, bypassing SSRF protections. This enables blind internal network reachability probing but does not allow direct metadata or credential theft because the connection is HTTPS-only with TLS verification and does not expose response data to the attacker. Other components using the same IP check logic may be affected if configured with user/operator-supplied targets, but these are not attacker-controlled. The vulnerability is classified as low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware that the SSRF guard does not block NAT64 IPv6 ranges and consider additional network-level controls or monitoring to prevent unauthorized internal access. The webhook client is not affected and enforces HTTPS scheme validation without IP checks.