CVE-2026-101058
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. An attacker can serve a manual that a victim registers, causing the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery).
Risk Assessment
The risk is the possibility of SSRF attacks against local services, potentially leading to data disclosure or unauthorized operations on the victim host if a loopback service answers unauthenticated requests with useful data.
Recommendation
Immediately upgrade the utcp-http package to version 1.1.12 or later, which rejects manuals fetched from a non-loopback origin that declare loopback tool URLs.
Other vulnerabilities in python-utcp
See all- CVE-2026-45370High
In python-utcp prior to version 1.1.3, the _prepare_environment() function in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call.
- CVE-2026-45369High
In the python-utcp library prior to version 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization. This allows an attacker to inject arbitrary shell commands.
- CVE-2026-101060High
python-utcp before version 1.1.4 contains a server-side request forgery (SSRF) vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
- CVE-2026-12210Medium
A vulnerability was detected in universal-tool-calling-protocol python-utcp version 1.1.0 in the utcp-gql/utcp-websocket component. Manipulation leads to server-side request forgery (SSRF). The attack can be initiated remotely. The exploit is public. The vendor did not respond.
Original NVD description (English source)
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensure_secure_url intentionally permits loopback HTTP for local development and native manuals bypassed the loopback check performed by the OpenAPI converter, an attacker who can serve a UTCP manual that a victim registers can cause the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery). The http, sse and streamable_http protocols are all affected. Reach is limited to loopback, and exploitation further requires a loopback service that answers unauthenticated requests with useful data. Fixed in utcp-http 1.1.12, which rejects manuals fetched from a non-loopback origin that declare loopback tool URLs, keyed off the final post-redirect discovery URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS