CVE-2026-45366

MediumCVSS 4.7

Published: 28/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The @utcp/http library before version 1.1.2 is vulnerable to blind Server-Side Request Forgery (SSRF). The flaw is caused by a trust-boundary inconsistency between manual discovery and tool invocation, where callTool() does not revalidate the URL and OpenApiConverter blindly trusts malicious OpenAPI specs.

Risk Assessment

An attacker can exploit this vulnerability to send requests to internal services within the organization's network, such as localhost servers or cloud metadata endpoints (e.g., 169.254.169.254), potentially leading to data leakage or privilege escalation.

Recommendation

Immediately update the @utcp/http library to version 1.1.2 or later, which includes a fix for the SSRF vulnerability.

Other vulnerabilities in @utcp/http

CVE-2026-101059High
utcp-http before version 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.

Original NVD description (English source)

typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS