Skip to content
OpenAdvisories

Vendor

stacklok

12 known vulnerabilities.

Products

minder 8 toolhive 4 toolhive-studio 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.9
    CVE-2026-54450

    ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway

    ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 ad…

    stacklok toolhive github.com/stacklok/toolhive Go
  • Low 2.4
    CVE-2025-47274

    ToolHive stores secrets in the state store with no encryption

    ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an MCP server container, versions of ToolHive prior to 0.0.33 inadvertently store secrets in the run co…

    stacklok toolhive