Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.
Published: 2026-09-15
Score: 2.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Internal reachability oracle via SSRF
Action: Apply Patch
AI Analysis

Impact

ToolHive, a utility for deploying Model Context Protocol servers, has an SSRF guard that mistakenly treats IPv6 NAT64 addresses for the prefixes 64:ff9b::/96 and 64:ff9b:1::/48 as public, even though they map to private, loopback, or link-local IPv4 targets. This is a CWE-918 server‑side request forgery vulnerability. This misclassification allows an attacker to supply a client_id URL through an external OAuth client, leading to a fetch of internal metadata behind a NAT64/DNS64 gateway. The gateway translates the allowed NAT64 address to the private address 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The request proceeds over HTTPS, verifies certificates, and does not reflect response bodies, so the effect is an internal reachability oracle rather than credential exfil because it does not use the IP guard, and the issue is fixed in ToolHive 0.29.1.

Affected Systems

The vulnerability affects Stacklok’s ToolHive utility, any installation earlier than version 0.29.1.

Risk and Exploitability

The CVSS score of 2.9 reflects a low‑severity issue, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it from the outside by directing an external OAuth client ID to a URL that resolves to a NAT64‑translated internal address; the process requires HTTPS with certificate validation but does not rely on privileged operations, making exploitation straightforward in a NAT64 environment.

Generated by OpenCVE AI on September 20, 2026 at 15:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ToolHive to version 0.29.1 or newer
  • Restrict or validate external OAuth client_id URLs to prevent reaching internal NAT64 endpoints
  • Monitor and block unexpected internal reachability probes or metadata service requests

Generated by OpenCVE AI on September 20, 2026 at 15:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-pph6-vfjv-vpjw ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Stacklok
Stacklok toolhive
Vendors & Products Stacklok
Stacklok toolhive

Tue, 15 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.
Title ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 2.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Stacklok Toolhive
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-15T16:13:16.652Z

Reserved: 2026-06-15T15:30:40.318Z

Link: CVE-2026-54450

cve-icon Vulnrichment

Updated: 2026-09-15T16:13:13.132Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T16:17:14.270

Modified: 2026-09-30T17:51:56.193

Link: CVE-2026-54450

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T16:00:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)