CVE-2026-44661
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Prior to 1.1.3, the utcp-http plugin is vulnerable to blind SSRF due to a trust-boundary inconsistency between manual discovery and tool invocation; an attacker hosting a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare internal URLs that are then used without revalidation.
Risk Assessment
An attacker can force requests to internal services on the agent host, potentially exposing data or interacting with internal resources.
Recommendation
Update python-utcp to version 1.1.3 or later.
Other vulnerabilities in python-utcp
See all- CVE-2026-101060High
python-utcp before version 1.1.4 contains a server-side request forgery (SSRF) vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
- CVE-2026-101058Medium
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. An attacker can serve a manual that a victim registers, causing the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery).
- CVE-2026-12210Medium
A vulnerability was detected in universal-tool-calling-protocol python-utcp version 1.1.0 in the utcp-gql/utcp-websocket component. Manipulation leads to server-side request forgery (SSRF). The attack can be initiated remotely. The exploit is public. The vendor did not respond.
- CVE-2026-45370High
In python-utcp prior to version 1.1.3, the _prepare_environment() function in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call.
- CVE-2026-45369High
In the python-utcp library prior to version 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization. This allows an attacker to inject arbitrary shell commands.
Original NVD description (English source)
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS