TI-2026-32561 Aliases CVE-2026-44661 GHSA-39j6-4867-gg4w

python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

LOW 21CWE-918Published 2026-05-14 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00175 7th percentileScored 2026-11-07

Fix Fixed python-utcp (universal-tool-calling-protocol): 1.1.2utcp-http (PyPI): 1.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
universal-tool-calling-protocol	python-utcp	before 1.1.2	1.1.2	Patch available	CNA
—	utcp-http (PyPI)	before 1.1.2	1.1.2	Patch available	GHSA-39j6-4867-gg4w

python-utcp Vendoruniversal-tool-calling-protocol Affected before 1.1.2 Fixed in 1.1.2 Patch available CNA
utcp-http (PyPI) Vendor— Affected before 1.1.2 Fixed in 1.1.2 Patch available GHSA-39j6-4867-gg4w

Remediation

Fix · CNA python-utcp (universal-tool-calling-protocol) Fixed in 1.1.2
Fix · GHSA-39j6-4867-gg4w utcp-http (PyPI) Fixed in 1.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44661
2026-10-03 Alias added: GHSA-39j6-4867-gg4w

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44661

Other 2

TI-2026-33160 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol CVSS 3.1HIGH 8.3
TI-2026-65093 python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects CVSS 4.0HIGH 8.4
TI-2026-65092 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass CVSS 4.0HIGH 7.1
TI-2026-10502 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery CVSS 4.0MEDIUM 5.3
TI-2026-65094 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass CVSS 4.0LOW 2.3
TI-2026-33161 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection CVSS 3.1HIGH 7.7

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences