stacklok / toolhive / 33268421157

70%

Build Type

push

github

Committed by web-flow

Commit Message

Guard OIDC discovery against private IPs (#6455)

Remote MCP authentication can derive an OIDC issuer from an untrusted realm. The OAuth configuration fallback previously performed discovery without the private-IP dial guard, allowing requests to loopback and private hosts.

Thread the caller-selected blockPrivateIPs policy through OIDC config creation, enforce the remote flow's !AllowPrivateIPs setting, preserve private issuer access for operator-configured token sources, and add listener-based regression tests.

Security-advisory: GHSA-cvhc-p56v-qm9r

Reported-by: Yanhaoxi (https://github.com/Yanhaoxi)

Coverage Stats

6 of 6 new or added lines in 3 files covered. (100.0%)

60 existing lines in 4 files now uncovered.

76307 of 109550 relevant lines covered (69.65%)

91.65 hits per line