{"cve":"CVE-2026-54450","nvd":{"published":"2026-09-15T16:17:14.270","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":2.9},"cvss_v3":null,"cwes":["CWE-918"],"references":["https://github.com/stacklok/toolhive/commit/26912af453d2040787983dbc9ab93a9019ec0468","https://github.com/stacklok/toolhive/releases/tag/v0.29.1","https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-54450","score":0.00327,"percentile":0.25507,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-pph6-vfjv-vpjw","url":"https://osv.dev/vulnerability/GHSA-pph6-vfjv-vpjw","summary":"ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway","modified":"2026-07-21T19:19:19.599729878Z","packages":[{"ecosystem":"Go","name":"github.com/stacklok/toolhive","purl":"pkg:golang/github.com/stacklok/toolhive","ranges":["<0.29.1"],"fixed":["0.29.1"]}]},{"id":"GO-2026-5996","url":"https://osv.dev/vulnerability/GO-2026-5996","summary":"ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive","modified":"2026-07-21T19:15:35.721639050Z","packages":[{"ecosystem":"Go","name":"github.com/stacklok/toolhive","purl":"pkg:golang/github.com/stacklok/toolhive","ranges":["<0.29.1"],"fixed":["0.29.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}