Skip to content
OpenAdvisories

Vendor

stacklok

12 known vulnerabilities.

Products

minder 8 toolhive 4 toolhive-studio 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-58197

    ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

    ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network i…

    stacklok toolhive toolhive-studio github.com/stacklok/toolhive Go
  • High 7.5
    CVE-2024-34084

    Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

    Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an atta…

    stacklok minder github.com/stacklok/minder Go
  • High 7.1
    CVE-2024-27916

    `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

    Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the r…

    stacklok minder github.com/stacklok/minder Go