CVE-2026-12210
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was detected in universal-tool-calling-protocol python-utcp version 1.1.0 in the utcp-gql/utcp-websocket component. Manipulation leads to server-side request forgery (SSRF). The attack can be initiated remotely. The exploit is public. The vendor did not respond.
Risk Assessment
The organization is at risk of SSRF attacks, which could allow an attacker to scan internal networks, access sensitive services, or perform unauthorized actions.
Recommendation
Immediately disable or isolate the utcp-gql/utcp-websocket component until a vendor patch is released, or apply temporary WAF rules to block suspicious requests.
Other vulnerabilities in python-utcp
See all- CVE-2026-45370High
In python-utcp prior to version 1.1.3, the _prepare_environment() function in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call.
- CVE-2026-45369High
In the python-utcp library prior to version 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization. This allows an attacker to inject arbitrary shell commands.
- CVE-2026-101060High
python-utcp before version 1.1.4 contains a server-side request forgery (SSRF) vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
- CVE-2026-101058Medium
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. An attacker can serve a manual that a victim registers, causing the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery).
Original NVD description (English source)
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS