Toolhive Studio
Monthly
Malicious or compromised Model Context Protocol (MCP) server containers run under ToolHive CLI before 0.30.1 or ToolHive Studio before 0.38.0 are not network-isolated by default, allowing them to reach Docker gateway addresses (host.docker.internal, gateway.docker.internal, 172.17.0.1) and, critically, ToolHive's own API and MCP proxy endpoints, which are reachable without authentication (CVSS vector PR:N). A hostile MCP server can therefore read exposed data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services without ever escaping the container, with the scope change (S:C) reflecting a pivot from the container into the ToolHive control plane; exploitation requires user interaction because an operator must choose to run the untrusted server (UI:R). The vendor rates this 8.8 (High/Critical); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the impact is severe for anyone running third-party MCP servers on Docker with default settings. Fixes are available in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, which flip network isolation to enabled by default.
Malicious or compromised Model Context Protocol (MCP) server containers run under ToolHive CLI before 0.30.1 or ToolHive Studio before 0.38.0 are not network-isolated by default, allowing them to reach Docker gateway addresses (host.docker.internal, gateway.docker.internal, 172.17.0.1) and, critically, ToolHive's own API and MCP proxy endpoints, which are reachable without authentication (CVSS vector PR:N). A hostile MCP server can therefore read exposed data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services without ever escaping the container, with the scope change (S:C) reflecting a pivot from the container into the ToolHive control plane; exploitation requires user interaction because an operator must choose to run the untrusted server (UI:R). The vendor rates this 8.8 (High/Critical); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the impact is severe for anyone running third-party MCP servers on Docker with default settings. Fixes are available in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, which flip network isolation to enabled by default.