What happened
ToolHive's core security model advertises container isolation for every MCP server it runs, but the default network permission profile shipped without actual network isolation, letting a malicious/compromised MCP server tool reach the host's internal network surface.
Why it matters
ToolHive is explicitly marketed as the secure way to run untrusted MCP servers; a default-config gap that defeats its own isolation promise directly undermines the primary security control organizations rely on when giving AI agents access to third-party MCP tools.
Attack vector
Locally-run MCP server containers use ToolHive's default network permission profile, which does not enforce network isolation, permitting a compromised or malicious MCP server container to reach host.docker.internal and other internal network endpoints it should be sandboxed away from.
Affected systems
ToolHive CLI < 0.30.1, ToolHive Studio < 0.38.0
Mitigation
Upgrade to ToolHive CLI 0.30.1+ or ToolHive Studio 0.38.0+, and explicitly configure network isolation profiles for MCP server containers.