python-utcp (utcp-http) before version 1.1.12 does not properly validate tool URLs in UTCP manuals fetched from remote origins, allowing SSRF attacks targeting the loopback interface. The vulnerability arises because ensure_secure_url permits loopback HTTP for local development, and native manuals bypass the loopback check performed by the OpenAPI converter. An attacker able to serve a UTCP manual that a victim registers can cause the client to issue requests to 127.0.0.1 services and receive response bodies, potentially exposing sensitive local services. The vulnerability affects the http, sse, and streamable_http protocols. The fix in 1.1.12 rejects manuals from non-loopback origins that declare loopback URLs, based on the final post-redirect discovery URL.

An attacker who can serve a malicious UTCP manual to a victim can induce the victim's client to send requests to local loopback services (127.0.0.1) that may be otherwise inaccessible remotely. This can lead to unauthorized disclosure of data from local services that respond to unauthenticated requests. The reach of the attack is limited to the loopback interface, and exploitation requires the presence of vulnerable local services. There are no known exploits in the wild at this time.

A fix is available in python-utcp (utcp-http) version 1.1.12. Users should upgrade to version 1.1.12 or later, which rejects UTCP manuals fetched from non-loopback origins that declare loopback tool URLs. No additional mitigation is required if the software is updated.