# ToolHive Run Config Secret Disclosure Access

- **Severity:** High
- **Signature ID:** `7b3f1c2e-9d4a-4a61-b8f5-2c6e0d914af3`
- **CVEs:** CVE-2025-47274

## Summary

Older versions of ToolHive, a tool for running MCP servers, stored the credentials used to launch those servers in plain, unencrypted text inside per-server config files. Any process or AI agent that can read the user's home directory can pull those credentials straight out of the files, no access to the actual secrets store required.

## How the attack works

An AI agent (or a script it runs) is directed to read, grep, or otherwise inspect the ToolHive runconfigs directory on disk. Because affected versions write live secrets into these files in plaintext, the file contents include working credential material. If the agent's tool call names that directory, or the tool's response returns file contents containing credential-like strings, the secrets have now been pulled into the agent's context and are exposed to anything downstream of that conversation. This does not require exploiting ToolHive itself — it only requires read access to the home directory and a tool call pointed at the right path.

## Why it matters

Live credentials for MCP server containers can leak into an AI agent's context and any logs, transcripts, or downstream systems that receive that context, giving an attacker a path to reuse those credentials without ever touching the intended secrets store.

## What you can do

- Upgrade ToolHive to 0.0.33 or later, which stops writing secrets into run config files.
- Restrict which directories AI agents and their tools are allowed to read, and explicitly exclude the toolhive runconfigs path unless a task requires it.
- Treat any past agent tool output that touched a runconfigs file as having potentially exposed live secrets, and rotate those credentials.
- Review agent transcripts and tool logs for references to the runconfigs directory to identify past unintended disclosures.

## Known benign look-alikes

- ToolHive operator or support engineer using an agent to troubleshoot a failing MCP server and legitimately inspecting a run config file.
- Agent-assisted upgrade or migration to ToolHive >= 0.0.33 that rewrites run configs to strip inline secrets (the remediation itself reads the files).
- Developers working on the ToolHive codebase, its tests, or its documentation, where the runconfigs path literal appears in source or prose.
- Backup, sync or dotfile tooling driven by an agent that archives the whole application-support or state directory and names the runconfigs path on the command line.
- Security teams reproducing the CVE in a lab (largely suppressed by filter_advisory when the advisory ID is present in context).

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-47274
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
- https://owasp.org/Top10/A04_2021-Insecure_Design/

---
Source: https://www.netzilo.com/threats/toolhive-runconfig-secret-read