—
GO-2026-6526
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
Quick fix
GO-2026-6526 — github.com/stacklok/toolhive: upgrade to the fixed version with the command below.
go get github.com/stacklok/toolhive@v0.30.1Details
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/stacklok/toolhive
Introduced in:
0Fixed in: 0.30.1Fix
go get github.com/stacklok/toolhive@v0.30.1References
- https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8[ADVISORY]
- https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712[FIX]
- https://github.com/stacklok/toolhive/pull/5583[FIX]
- https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0[WEB]
- https://github.com/stacklok/toolhive-studio/pull/2469[WEB]
- https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0[WEB]
- https://github.com/stacklok/toolhive/releases/tag/v0.30.1[WEB]