CVE-2026-58196: ToolHive MCP Server SSRF Vulnerability

CVE-2026-58196 Overview

CVE-2026-58196 is a Server-Side Request Forgery (SSRF) vulnerability in ToolHive, a utility that simplifies the deployment and management of Model Context Protocol (MCP) servers. The flaw resides in remote.Handler.Authenticate in pkg/auth/remote/handler.go, which invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go. The host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can coerce ToolHive to issue GET requests to internal-only services outside the container. The vulnerability affects versions prior to 0.31.0 and is tracked as [CWE-918].

Critical Impact
Attackers controlling a remote MCP server can reach link-local, RFC1918, and other internal HTTP services, and can retrieve AWS IMDSv1 metadata credentials when available.

Affected Products

Stacklok ToolHive versions prior to 0.31.0
ToolHive pkg/auth/remote/handler.go component
ToolHive pkg/auth/discovery/discovery.go component

Discovery Timeline

2026-09-15 - CVE-2026-58196 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-58196

Vulnerability Analysis

The vulnerability exists in ToolHive's authentication discovery flow. When a user connects to a remote MCP server, remote.Handler.Authenticate calls discovery.DetectAuthenticationFromServer to negotiate authentication parameters. A malicious server responds with a WWW-Authenticate header containing an attacker-controlled resource_metadata URL. ParseWWWAuthenticate extracts this URL, and subsequent calls to FetchResourceMetadata, OIDC issuer discovery, and well-known discovery issue GET requests to the specified destination.

The host-side HTTP clients do not enforce host or scheme allowlists, follow redirects unconditionally, and skip private-address checks. This lets an attacker pivot outbound requests toward internal services. The demonstrated primitive can retrieve AWS metadata credentials on hosts where IMDSv1 accepts unauthenticated GET requests. IMDSv2 and GCP metadata endpoints require additional headers not satisfied by the demonstrated request.

Root Cause

The affected clients did not invoke IsPrivateIP before dispatching discovery requests. This differs from the Dynamic Client Registration (DCR) resolver path, which already refused redirects. The issue is independent of the separate NAT64 guard omission.

Attack Vector

The user initiates a connection to a remote MCP server they intend to use. The server controls the discovery destination through its WWW-Authenticate response. ToolHive then issues GET requests to internal targets on the operator's behalf, producing reachability oracles, error oracles, and in some environments credential retrieval.

// Security patch in pkg/auth/oauth/oidc.go
// metadataURL originates from untrusted remote-server discovery. When
// blockPrivateIPs is true the default client refuses to dial private, loopback,
// or link-local addresses on every hop (SSRF guard); callers pass false when the
// operator-configured target is itself internal.
func DiscoverActualIssuer(
	ctx context.Context,
	metadataURL string,
	blockPrivateIPs bool,
) (*oauthproto.OIDCDiscoveryDocument, error) {
	return discoverOIDCEndpointsWithClientAndValidation(ctx, metadataURL, nil, false, false, blockPrivateIPs)
}

Source: GitHub Commit 4ea6afb

Detection Methods for CVE-2026-58196

Indicators of Compromise

Outbound HTTP GET requests from ToolHive containers to link-local addresses such as 169.254.169.254.
Discovery requests to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from the ToolHive process.
Unexpected WWW-Authenticate responses from remote MCP servers containing internal resource_metadata URLs.
HTTP redirect chains from remote MCP endpoints that terminate at cloud metadata services.

Detection Strategies

Instrument ToolHive host networking to log all outbound destinations from discovery.DetectAuthenticationFromServer code paths.
Alert on any authentication discovery request whose destination resolves to a private, loopback, or link-local address.
Correlate remote MCP session initiation events with subsequent internal HTTP traffic to identify SSRF pivots.

Monitoring Recommendations

Deploy egress firewall rules that block ToolHive containers from reaching cloud instance metadata endpoints.
Monitor IMDSv1 access logs on AWS instances hosting ToolHive for unexpected credential retrieval events.
Audit ToolHive version inventory across environments to identify hosts running versions prior to 0.31.0.

How to Mitigate CVE-2026-58196

Immediate Actions Required

Upgrade ToolHive to version 0.31.0 or later where the SSRF guard is enforced in the discovery clients.
Enforce IMDSv2 on AWS instances hosting ToolHive to require session tokens for metadata requests.
Restrict outbound network access from ToolHive containers to only the MCP endpoints operators intend to use.

Patch Information

The fix is available in ToolHive v0.31.0. The patch introduces a blockPrivateIPs parameter across the OIDC discovery path so the default HTTP client refuses to dial private, loopback, or link-local addresses on every hop. See the GHSA-pr64-jmmf-jp54 advisory and the remediation commit for implementation details.

Workarounds

Place ToolHive in a network segment with strict egress filtering that denies traffic to internal ranges and metadata endpoints.
Only connect to remote MCP servers from operators and vendors you trust to send benign WWW-Authenticate headers.
Require IMDSv2 on all cloud hosts running ToolHive to neutralize the demonstrated credential-retrieval primitive.

bash

# Upgrade ToolHive to the patched release
go install github.com/stacklok/toolhive/cmd/thv@v0.31.0

# Enforce IMDSv2 on AWS instances hosting ToolHive
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled