ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (CVE-2026-58196) | HOL Guard CVE