{"id":"CVE-2026-54450","summary":"ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway","details":"ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.","aliases":["GHSA-pph6-vfjv-vpjw","GO-2026-5996"],"modified":"2026-09-17T03:47:10.594394312Z","published":"2026-09-15T15:47:39.377Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54450.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/stacklok/toolhive/releases/tag/v0.29.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54450.json"},{"type":"ADVISORY","url":"https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54450"},{"type":"FIX","url":"https://github.com/stacklok/toolhive/commit/26912af453d2040787983dbc9ab93a9019ec0468"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stacklok/toolhive","events":[{"introduced":"0"},{"fixed":"26912af453d2040787983dbc9ab93a9019ec0468"},{"fixed":"83e9eaec177c85c791a337b8c99d2e43c06904a1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.29.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v0.29.0","v0.28.3","v0.28.2","v0.28.1","v0.28.0","v0.27.2","v0.27.1","v0.27.0","v0.26.1","v0.26.0","v0.25.0","v0.24.1","v0.24.0","v0.23.1","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.1","v0.13.0","v0.12.5","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.2","v0.10.1","v0.10.0","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.3","toolhive-operator-crds-0.0.106","toolhive-operator-crds-0.0.105","v0.8.2","toolhive-operator-0.5.28","v0.8.1","toolhive-operator-crds-0.0.104","toolhive-operator-crds-0.0.103","toolhive-operator-0.5.27","toolhive-operator-crds-0.0.102","toolhive-operator-0.5.26","toolhive-operator-crds-0.0.101","toolhive-operator-crds-0.0.100","toolhive-operator-crds-0.0.99","v0.8.0","toolhive-operator-crds-0.0.98","toolhive-operator-crds-0.0.97","toolhive-operator-0.5.25","v0.7.2","toolhive-operator-0.5.24","v0.7.1","toolhive-operator-0.5.23","v0.7.0","toolhive-operator-crds-0.0.96","toolhive-operator-crds-0.0.95","toolhive-operator-0.5.22","toolhive-operator-crds-0.0.94","toolhive-operator-0.5.21","toolhive-operator-crds-0.0.93","toolhive-operator-crds-0.0.92","v0.6.17","toolhive-operator-crds-0.0.91","toolhive-operator-0.5.20","toolhive-operator-crds-0.0.90","toolhive-operator-crds-0.0.89","toolhive-operator-0.5.19","v0.6.16","toolhive-operator-0.5.18","toolhive-operator-crds-0.0.88","toolhive-operator-0.5.17","toolhive-operator-0.5.16","v0.6.15","toolhive-operator-crds-0.0.86","toolhive-operator-0.5.15","v0.6.14","toolhive-operator-0.5.14","toolhive-operator-crds-0.0.85","toolhive-operator-0.5.13","toolhive-operator-crds-0.0.84","v0.6.13","toolhive-operator-crds-0.0.83","toolhive-operator-0.5.12","v0.6.12","toolhive-operator-crds-0.0.82","toolhive-operator-crds-0.0.81","toolhive-operator-crds-0.0.80","toolhive-operator-crds-0.0.79","toolhive-operator-crds-0.0.78","toolhive-operator-0.5.11","toolhive-operator-0.5.10","toolhive-operator-crds-0.0.77","toolhive-operator-crds-0.0.76","toolhive-operator-crds-0.0.75","toolhive-operator-0.5.9","toolhive-operator-0.5.8","toolhive-operator-crds-0.0.74","v0.6.11","toolhive-operator-0.5.7","v0.6.10","toolhive-operator-0.5.6","toolhive-operator-crds-0.0.73","toolhive-operator-crds-0.0.72","toolhive-operator-0.5.5","toolhive-operator-0.5.4","v0.6.9","toolhive-operator-crds-0.0.71","toolhive-operator-crds-0.0.70","toolhive-operator-crds-0.0.69","toolhive-operator-crds-0.0.68","toolhive-operator-crds-0.0.67","v0.6.8","toolhive-operator-crds-0.0.66","toolhive-operator-crds-0.0.65","toolhive-operator-crds-0.0.64","toolhive-operator-crds-0.0.63","v0.6.7","toolhive-operator-crds-0.0.62","toolhive-operator-crds-0.0.61","toolhive-operator-crds-0.0.60","toolhive-operator-0.5.3","v0.6.6","toolhive-operator-crds-0.0.59","toolhive-operator-crds-0.0.58","toolhive-operator-0.5.2","toolhive-operator-crds-0.0.57","toolhive-operator-crds-0.0.56","v0.6.5","v0.6.4","v0.6.3","toolhive-operator-0.5.1","toolhive-operator-crds-0.0.55","toolhive-operator-0.5.0","v0.6.2","v0.6.1","toolhive-operator-crds-0.0.54","v0.6.0","toolhive-operator-crds-0.0.53","toolhive-operator-0.4.0","toolhive-operator-0.3.7","toolhive-operator-crds-0.0.52","toolhive-operator-crds-0.0.51","toolhive-operator-0.3.6","v0.5.2","toolhive-operator-crds-0.0.50","toolhive-operator-crds-0.0.49","toolhive-operator-0.3.5","toolhive-operator-crds-0.0.48","toolhive-operator-0.3.4","v0.5.1","toolhive-operator-crds-0.0.47","toolhive-operator-0.3.2","v0.5.0","toolhive-operator-crds-0.0.46","toolhive-operator-crds-0.0.45","toolhive-operator-crds-0.0.44","toolhive-operator-crds-0.0.43","toolhive-operator-0.3.1","v0.4.2","toolhive-operator-crds-0.0.42","v0.4.1","toolhive-operator-crds-0.0.41","toolhive-operator-crds-0.0.40","toolhive-operator-crds-0.0.39","toolhive-operator-0.3.0","v0.4.0","toolhive-operator-crds-0.0.38","toolhive-operator-0.2.26","toolhive-operator-0.2.25","toolhive-operator-0.2.24","v0.3.11","v0.3.10","toolhive-operator-crds-0.0.36","v0.3.9","toolhive-operator-crds-0.0.35","toolhive-operator-0.2.23","toolhive-operator-0.2.22","v0.3.8","toolhive-operator-crds-0.0.34","toolhive-operator-0.2.21","toolhive-operator-crds-0.0.33","toolhive-operator-0.2.20","v0.3.7","toolhive-operator-crds-0.0.32","toolhive-operator-crds-0.0.31","v0.3.6","toolhive-operator-0.2.19","toolhive-operator-crds-0.0.30","toolhive-operator-crds-0.0.29","toolhive-operator-crds-0.0.27","toolhive-operator-0.2.18","toolhive-operator-0.2.17","v0.3.5","v0.3.4","toolhive-operator-0.2.16","toolhive-operator-0.2.15","v0.3.3","toolhive-operator-crds-0.0.26","v0.3.2","v0.3.1","toolhive-operator-crds-0.0.25","toolhive-operator-0.2.14","v0.3.0","toolhive-operator-0.2.13","toolhive-operator-crds-0.0.24","toolhive-operator-crds-0.0.23","toolhive-operator-0.2.12","toolhive-operator-crds-0.0.22","toolhive-operator-crds-0.0.21","toolhive-operator-0.2.11","v0.2.17","toolhive-operator-0.2.8","toolhive-operator-crds-0.0.19","v0.2.16","v0.2.15","v0.2.14","toolhive-operator-crds-0.0.18","toolhive-operator-crds-0.0.17","v0.2.13","v0.2.12","toolhive-operator-crds-0.0.16","v0.2.11","v0.2.10","v0.2.9","toolhive-operator-0.2.6","toolhive-operator-0.2.5","toolhive-operator-0.2.4","v0.2.8","toolhive-operator-0.2.3","toolhive-operator-crds-0.0.15","toolhive-operator-0.2.2","toolhive-operator-crds-0.0.14","v0.2.7","v0.2.6","v0.2.5","v0.2.4","toolhive-operator-crds-0.0.13","v0.2.3","v0.2.2","v0.2.1","toolhive-operator-crds-0.0.12","toolhive-operator-0.2.1","toolhive-operator-0.2.0","v0.2.0","v0.1.9","toolhive-operator-0.1.8","v0.1.8","toolhive-operator-crds-0.0.11","toolhive-operator-crds-0.0.10","v0.1.7","v0.1.6","toolhive-operator-0.1.5","v0.1.5","v0.1.4","v0.1.3","v0.1.2","toolhive-operator-crds-0.0.9","toolhive-operator-crds-0.0.8","v0.1.1","toolhive-operator-0.1.0","v0.1.0","v0.0.48","toolhive-operator-crds-0.0.7","v0.0.47","v0.0.46","toolhive-operator-0.0.11","v0.0.45","v0.0.44","v0.0.43","toolhive-operator-0.0.10","v0.0.42","v0.0.41","v0.0.40","toolhive-operator-crds-0.0.6","toolhive-operator-crds-0.0.5","toolhive-operator-0.0.9","toolhive-operator-0.0.8","v0.0.39","toolhive-operator-crds-0.0.4","toolhive-operator-0.0.7","v0.0.38","toolhive-operator-0.0.6","v0.0.37","toolhive-operator-0.0.5","v0.0.36","v0.0.35","toolhive-operator-0.0.4","v0.0.34","toolhive-operator-crds-0.0.3","toolhive-operator-0.0.3","v0.0.33","v0.0.32","v0.0.31","v0.0.30","v0.0.29","v0.0.28","v0.0.27","v0.0.26","v0.0.25","v0.0.24","v0.0.23","v0.0.22","v0.0.21","v0.0.20","v0.0.19","v0.0.18","v0.0.17","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54450.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}