Vulnerabilities

TI-2026-41912 CVE-2026-58197 · GHSA-qg2g-g9w3-m5h8

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

HIGH 73

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers.

CVSS 3.1HIGH 8.8 Adjacent network No auth User interaction EPSS 0.00372 Published 2026-09-18 Fixed in 0.30.1, 0.38.0 CWE-284

TI-2026-41911 CVE-2026-58196 · GHSA-pr64-jmmf-jp54

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

MEDIUM 55

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00429 Published 2026-09-15 Fixed in 0.31.0 CWE-918

TI-2026-39313 CVE-2026-54450 · GHSA-pph6-vfjv-vpjw

Server-side request forgery in stacklok toolhive

LOW 14

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00327 Published 2026-09-15 Fixed in 0.29.1 CWE-918

TI-2025-29804 CVE-2025-47274

ToolHive stores secrets in the state store with no encryption

LOW 11

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers.

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00135 Published 2025-05-12 Fixed in 0.0.33 CWE-311

TI-2024-25220 CVE-2024-37904 · GHSA-hpcg-xjq5-g666

Denial of service from maliciously configured Git repository in Minder

LOW 26

Minder is an open source Software Supply Chain Security Platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0046 Published 2024-06-18 Fixed in 0.0.52 CWE-400

TI-2024-23307 CVE-2024-35238 · GHSA-8fmj-33gw-g7pw

Denial of service of Minder Server from maliciously crafted GitHub attestations

LOW 25

Minder by Stacklok is an open source software supply chain security platform.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0053 Published 2024-05-27 Fixed in 0.0.51 CWE-770

TI-2024-23266 CVE-2024-35194 · GHSA-crgc-2583-rw27

Stacklok Minder vulnerable to denial of service from maliciously crafted templates

LOW 24

Minder is a software supply chain security platform.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00414 Published 2024-05-20 Fixed in 0.0.50 CWE-400

TI-2024-23259 CVE-2024-35185 · GHSA-fjw8-3gp8-4cvx

Denial of service of Minder Server with attacker-controlled REST endpoint

LOW 24

Minder is a software supply chain security platform.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00465 Published 2024-05-16 Fixed in 0.0.49 CWE-400

TI-2024-22541 CVE-2024-34084 · GHSA-9c5w-9q3f-3hv7

Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

HIGH 72

Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2024-05-07 Fixed in 0.0.48 CWE-400

TI-2024-20819 CVE-2024-31455 · GHSA-ggp5-28x4-xcj9

Minder GetRepositoryByName data leak

LOW 21

Minder by Stacklok is an open source software supply chain security platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00765 Published 2024-04-09 Fixed in 0.0.40 CWE-200

Vulnerabilities

Filters