GO-2026-5996
and 1 other vulnerabilities
GO-2026-5996 : ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive
GO-2026-6002 : ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive
Discover Packages
github.com/stacklok/toolhive
cmd
thv-operator
app
package
Version:
v0.29.0
Opens a new window with list of versions in this module.
Published: Jun 3, 2026
License: Apache-2.0
Opens a new window with license information.
Imports: 26
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
¶
Package app contains the entry-point and pre-Run setup for the ToolHive
Kubernetes Operator. Run is the single exported entry point and absorbs
all behavior that used to live in cmd/thv-operator/main.go's func main().
Run is the operator entry point. It blocks until the signal context is cancelled; on fatal setup errors it calls os.Exit(1).
¶
Click to show internal directories.
Click to hide internal directories.
Affected by 
Documentation
¶
Source Files