CVE-2026-54450
Received Received - Intake

IPv6 NAT64 Misclassification in ToolHive Allows Internal Network Probing

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54450
EUVD
EUVD-2026-78817

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
stacklok toolhive to 0.29.1 (exc)
stacklok toolhive 0.29.1
toohive toohive 0.29.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54450 is a Server-Side Request Forgery (SSRF) vulnerability in ToolHive versions up to 0.29.0. The issue occurs because the SSRF protection function, IsPrivateIP, fails to recognize IPv6 NAT64 address ranges (64:ff9b::/96 and 64:ff9b:1::/48). This allows an attacker to bypass SSRF protections by providing a NAT64-encoded URL that resolves to internal or link-local addresses behind a NAT64/DNS64 gateway.

Detection Guidance
  • Check ToolHive version with: toolhive version. If version is below 0.29.1, the system is vulnerable.
  • Inspect network traffic for outbound connections to NAT64 prefixes 64:ff9b::/96 or 64:ff9b:1::/48.
  • Monitor logs for SSRF attempts via OAuth client_id URLs containing NAT64-encoded addresses.
  • Use packet capture tools like tcpdump or Wireshark to detect connections to internal IPs from external sources.
Impact Analysis

The vulnerability allows an attacker to probe internal network services for reachability, such as cloud metadata endpoints (e.g., 169.254.169.254). While it does not enable credential theft, it provides a way to map internal network structure and identify potential targets for further attacks.

Compliance Impact

This vulnerability primarily enables internal network reconnaissance rather than direct data exfiltration, so it does not directly violate GDPR or HIPAA requirements for data protection. However, it could indirectly impact compliance by allowing unauthorized probing of internal systems that may host sensitive data, potentially violating security controls mandated by these regulations.

Mitigation Strategies
  • Upgrade ToolHive to version 0.29.1 or later immediately to apply the SSRF fix.
  • Block outbound traffic to NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48 at the firewall level.
  • Review and restrict OAuth client_id URLs to prevent attacker-controlled NAT64-encoded inputs.
  • Enable strict validation for all IP addresses in network functions, including IPv6 NAT64 decoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart