Read the docs
TI-2026-65090 Aliases CVE-2026-101057GHSA-vr54-j4qq-9vj9

utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

Priority LOW 11CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensure_secure_url validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template naming a plain-HTTP, non-loopback MCP server URL is dialed as configured, exposing the MCP handshake to network interception and permitting cleartext connections to internal hosts. The mcpServers configuration is operator-authored rather than remote data, and the connection is an MCP handshake rather than an arbitrary request returning a body, which limits practical exploitation; the OAuth2 token_url credential path described in the original report was not reachable in the affected versions, because the OAuth2 handler was never invoked and the call template's auth field was not read. Fixed in utcp-mcp 1.1.3, which validates server URLs before any connection is made.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00111 1st percentileScored 2026-11-07
Fix Fixed python-utcp (universal-tool-calling-protocol): 1.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
universal-tool-calling-protocolpython-utcpbefore 1.1.31.1.3Patch availableCNA

Remediation

  • Fix · CNA python-utcp (universal-tool-calling-protocol) Fixed in 1.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101057
  2. 2026-10-03 Alias added: GHSA-vr54-j4qq-9vj9

References

Advisory 1

  • TI-2026-33160 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol CVSS 3.1HIGH 8.3
  • TI-2026-65093 python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects CVSS 4.0HIGH 8.4
  • TI-2026-65092 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass CVSS 4.0HIGH 7.1
  • TI-2026-10502 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery CVSS 4.0MEDIUM 5.3
  • TI-2026-65094 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass CVSS 4.0LOW 2.3
  • TI-2026-33161 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection CVSS 3.1HIGH 7.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences