VDB
KO
—

GO-2026-5996

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

Quick fix

GO-2026-5996 — github.com/stacklok/toolhive: upgrade to the fixed version with the command below. 

go get github.com/stacklok/toolhive@v0.29.1

Details

ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/stacklok/toolhive
Introduced in: 0 Fixed in: 0.29.1
Fix go get github.com/stacklok/toolhive@v0.29.1

References