GHSA-PR64-JMMF-JP54 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

Security Advisory: SSRF in remote MCP server authentication discovery Severity: High. CWE: CWE-918. Affected: ToolHive through the latest release v0.29.3 and current main HEAD b672d82f, 2026-06-12; re-verified 2026-06-14. FetchResourceMetadata and the discovery clients remain unguarded; no commit...

PT-2026-60392

Name of the Vulnerable Software and Affected Versions ToolHive versions 0.x through 0.29.3 Description ToolHive contains a Server-Side Request Forgery SSRF issue during remote MCP server authentication discovery. The application issues outbound HTTP requests to URLs controlled by a remote MCP...