Read the docs
TI-2026-65091 Aliases CVE-2026-101058GHSA-88pp-fjxx-6p68

python-utcp before 1.1.12 SSRF via Remote HTTP Manual

Priority LOW 30CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensure_secure_url intentionally permits loopback HTTP for local development and native manuals bypassed the loopback check performed by the OpenAPI converter, an attacker who can serve a UTCP manual that a victim registers can cause the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery). The http, sse and streamable_http protocols are all affected. Reach is limited to loopback, and exploitation further requires a loopback service that answers unauthenticated requests with useful data. Fixed in utcp-http 1.1.12, which rejects manuals fetched from a non-loopback origin that declare loopback tool URLs, keyed off the final post-redirect discovery URL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed python-utcp (universal-tool-calling-protocol): 1.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
universal-tool-calling-protocolpython-utcpbefore 1.1.121.1.12Patch availableCNA

Remediation

  • Fix · CNA python-utcp (universal-tool-calling-protocol) Fixed in 1.1.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101058
  2. 2026-10-03 Alias added: GHSA-88pp-fjxx-6p68

References

Advisory 1

  • TI-2026-33160 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol CVSS 3.1HIGH 8.3
  • TI-2026-65093 python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects CVSS 4.0HIGH 8.4
  • TI-2026-65092 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass CVSS 4.0HIGH 7.1
  • TI-2026-10502 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery CVSS 4.0MEDIUM 5.3
  • TI-2026-65094 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass CVSS 4.0LOW 2.3
  • TI-2026-33161 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection CVSS 3.1HIGH 7.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences