Skip to content
OpenAdvisories

Vendor

stacklok

12 known vulnerabilities.

Products

minder 8 toolhive 4 toolhive-studio 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-58196

    ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

    ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery…

    stacklok toolhive github.com/stacklok/toolhive Go
  • Medium 5.7
    CVE-2024-37904

    Denial of service from maliciously configured Git repository in Minder

    Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the `github.com/go-git/go-git/v5` li…

    stacklok minder github.com/stacklok/minder Go
  • Medium 5.3
    CVE-2024-35238

    Denial of service of Minder Server from maliciously crafted GitHub attestations

    Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack which could allow an attacker to crash the Minder server and deny other users access to it. The root…

    stacklok minder github.com/stacklok/minder Go
  • Medium 5.3
    CVE-2024-35194

    Stacklok Minder vulnerable to denial of service from maliciously crafted templates

    Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate string…

    stacklok minder github.com/stacklok/minder Go
  • Medium 5.3
    CVE-2024-35185

    Denial of service of Minder Server with attacker-controlled REST endpoint

    Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to int…

    stacklok minder github.com/stacklok/minder Go
  • Medium 4.3
    CVE-2024-31455

    Minder GetRepositoryByName data leak

    Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing…

    stacklok minder github.com/stacklok/minder Go
  • Medium 4.6
    CVE-2024-27093

    Minder trusts client-provided mapping from repo name to upstream ID

    Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate …

    stacklok minder github.com/stacklok/minder Go