ToolHive containerized MCP servers bypass isolation via host.docker.internal

Containerized MCP servers in ToolHive can reach host services through host.docker.internal, enabling lateral movement and tool manipulation. This bypasses the container isolation model that is ToolHive's core security feature.

Disclosed 18 September 2026 · Record updated 18 September 2026

Impact

Compromised or malicious MCP servers can perform lateral movement to reach the ToolHive control plane, other MCP server proxies, and host services including Kubernetes APIs and LLM services without container escape.

Our coverage

Nested glass boxes stack inside each other, but a thin crack runs through all layers—a metal hand reaches from the innermost box straight through to shake hands with machinery in the outer room.

Vulnerabilities

ToolHive containers can reach host services, advisory warns

A GitHub security advisory published on 18 September 2026 says Stacklok's ToolHive lets sandboxed MCP servers call the host, undermining its isolation model.

18 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-qg2g-g9w3-m5h8