stacklok vulnerabilities

CVEs per yearBy the year they were published

1. 20248
2. 20251
3. 20263

Newest CVEs

• CVE-2026-58197

  ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

  stacklok · toolhive

  High8.8
• CVE-2026-58196

  ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

  stacklok · toolhive

  Medium4.7
• CVE-2026-54450

  ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway

  stacklok · toolhive

  Low2.9
• CVE-2025-47274

  ToolHive stores secrets in the state store with no encryption

  stacklok · toolhive

  Low2.4
• CVE-2024-37904

  Denial of service from maliciously configured Git repository in Minder

  stacklok · minder

  Medium5.7
• CVE-2024-35238

  Denial of service of Minder Server from maliciously crafted GitHub attestations

  stacklok · minder

  Medium5.3
• CVE-2024-35194

  Stacklok Minder vulnerable to denial of service from maliciously crafted templates

  stacklok · minder

  Medium5.3
• CVE-2024-35185

  Denial of service of Minder Server with attacker-controlled REST endpoint

  stacklok · minder

  Medium5.3
• CVE-2024-34084

  Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

  stacklok · minder

  High7.5
• CVE-2024-31455

  Minder GetRepositoryByName data leak

  stacklok · minder

  Medium4.3