ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (CVE-2026-58196)
Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can place a resource_metadata URL in WWW-Authenticate for ParseWWWAuthenticate to extract, after which FetchResourceMetadata, OIDC issuer discovery, and well-known discovery can issue GET requests to link-local, RFC1918, or other internal services outside the server's container. The user connects to a server that the user intends to use, but the server controls the internal destination; this path does not depend on the separate NAT64 guard omission because the affected clients did not invoke IsPrivateIP, and it differs from the DCR resolver path that already refused redirects. The demonstrated primitive reaches internal-only HTTP services and reachability or error oracles, and can retrieve AWS metadata credentials where IMDSv1 accepts an unauthenticated GET, while IMDSv2 and GCP metadata prerequisites are not satisfied by the demonstrated request. This vulnerability is fixed in 0.31.0.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ToolHive's remote.Handler.Authenticate function in versions before 0.31.0 invokes discovery.DetectAuthenticationFromServer, which uses host-side HTTP clients that trust remote-server-controlled authentication discovery URLs. These clients follow redirects without restrictions on host or scheme and do not consistently block private IP addresses. A malicious MCP server can exploit this by placing a resource_metadata URL in the WWW-Authenticate header, causing the client to issue GET requests to internal network services, including link-local and RFC1918 addresses. This SSRF vulnerability bypasses container isolation and can retrieve AWS metadata credentials via IMDSv1, though IMDSv2 and GCP metadata protections are not bypassed by the demonstrated attack. The vulnerability is addressed in ToolHive version 0.31.0.
Potential Impact
An attacker controlling or compromising a remote MCP server can exploit this SSRF vulnerability to make the client perform unauthorized HTTP requests to internal network services. This can lead to information disclosure, including retrieval of AWS IMDSv1 metadata credentials, potentially enabling further compromise of cloud infrastructure. The vulnerability bypasses container isolation, increasing the attack surface. However, exploitation requires interaction with a malicious MCP server and the vulnerability does not affect IMDSv2 or GCP metadata services under the demonstrated conditions.
Mitigation Recommendations
This vulnerability is fixed in ToolHive version 0.31.0. Users should upgrade to version 0.31.0 or later to remediate this issue. No additional mitigations are specified by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pr64-jmmf-jp54
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58196"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a58b40268715ace43d66f1e
Added to database: 07/16/2026, 10:35:46 UTC
Last enriched: 09/15/2026, 22:16:13 UTC
Last updated: 10/16/2026, 06:48:17 UTC
Views: 245
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.