# ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Default ToolHive network profile lets containerized MCP servers reach host.docker.internal, hitting the unauthenticated ToolHive API and other MCP proxies for lateral movement.

- Payout: Research
- Severity: high
- Program: ToolHive
- Found by: xxradar, jhrozek
- Disclosed: 2026-09-18
- CVE: CVE-2026-58197
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-qg2g-g9w3-m5h8
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8
- Tags: area:ai domain:ai domain:cloud impact:internal-access impact:privesc kind:research platform:ghsa sev:high tech:docker tech:llm vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** Containerized MCP server networking / ToolHive MCP proxy and API endpoints
**Root cause:** Default network permission profile sets insecure_allow_all: true, permitting outbound connections to host.docker.internal; ToolHive API and MCP proxy endpoints have no authentication, so any reachable client can interact fully.
**Steps:**
1. Start filesystem MCP server with defaults: `thv run filesystem -- /tmp`
2. From inside the container, POST an MCP initialize to the control plane: `wget -qO- --header="Content-Type: application/json" --header="Accept: application/json" --post-data='{"jsonrpc":"2.0","method":"initialize",...}' http://host.docker.internal:50444/mcp`
3. Observe successful handshake returning serverInfo toolhive-mcp v0.9.3
4. POST `tools/list` to another MCP proxy port (e.g. 64965) to enumerate and call its tools
5. Reach other host services such as `https://host.docker.internal:6443/version` (Kubernetes) and `http://host.docker.internal:11434/api/tags` (Ollama)
**How found:** Reporter tested from inside the filesystem MCP container started with default settings, probing host.docker.internal ports for the ToolHive control plane, other MCP proxies, and host services.
**Exploitation:** A malicious or compromised containerized MCP server port-scans host.docker.internal, performs MCP handshakes on discovered ports, and calls privileged tools on native MCP servers (execute_command, write_file) for full host compromise without a container escape; it can also manipulate ToolHive via the unauthenticated API, read files via another server's proxy, or abuse Ollama.
**Escalation:** Pivots from a low-privilege container to privileged native MCP tools (execute_command/write_file) and to the ToolHive control plane, achieving host compromise without a container escape.
**Insight:** When auditing containerized agent/tool runtimes, check whether the default network profile allows host.docker.internal or the Docker gateway (172.17.0.1); unauthenticated localhost-bound control-plane and proxy ports become reachable lateral-movement targets from any spawned container.