—
GO-2026-6002
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive
Quick fix
GO-2026-6002 — github.com/stacklok/toolhive: upgrade to the fixed version with the command below.
go get github.com/stacklok/toolhive@v0.31.0Details
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/stacklok/toolhive
Introduced in:
0 Fixed in: 0.31.0 Fix
go get github.com/stacklok/toolhive@v0.31.0