A critical security flaw in Stacklok ToolHive allows unauthenticated, container-based attacks to access host services and manipulate the control plane due to improper network isolation.

The software fails to enforce network isolation for Model Context Protocol (MCP) server containers and lacks authentication for API and proxy endpoints. An attacker can leverage a compromised MCP server to communicate with host local services or the ToolHive control plane, effectively bypassing container boundary protections.

The vulnerability carries a CVSS score of 8.8, reflecting a high potential for total compromise of the affected environment. Successful exploitation allows unauthorized parties to exfiltrate sensitive data, manipulate internal workloads, and disrupt critical business services managed by the ToolHive platform.

Immediate Action: Update ToolHive CLI to version 0.30.1 or later, and ToolHive Studio to version 0.38.0 or later, to restore proper network isolation and authentication requirements.

Proactive Monitoring: Monitor logs for unauthorized access attempts to internal management APIs and investigate any unexpected network traffic originating from MCP server containers toward the host gateway.

Compensating Controls: Implement strict network security group rules or firewall policies that restrict container access to host local services, and ensure that ToolHive deployments are placed within trusted network segments.

Public Exploit Available: Unknown.

Given the potential for full control plane compromise and lateral movement within the host environment, organizations must prioritize upgrading to the patched versions immediately. Administrators should treat this as a high-priority remediation task to prevent unauthorized access to sensitive infrastructure and data flows managed by ToolHive.