The python-utcp project’s utcp-http plugin before version 1.1.3 is vulnerable to a blind SSRF due to inconsistent validation of URLs. While register_manual() validates discovery URLs against an HTTPS and loopback allowlist, call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url without revalidation. The OpenAPI converter trusts the servers[0].url field from attacker-controlled OpenAPI specifications, enabling attackers to direct requests to internal IP addresses such as 127.0.0.1 or 169.254.169.254. This affects all HTTP-based protocols in the plugin and allows attackers to coerce the agent into making requests to internal services. The vulnerability is resolved in version 1.1.3.

An attacker who can host a malicious OpenAPI specification on a legitimate HTTPS endpoint can exploit this vulnerability to cause the python-utcp agent to send requests to internal network services that are normally inaccessible externally. This can lead to information disclosure or interaction with internal services, but the CVSS score of 4.7 and medium severity rating indicate limited impact, with no known exploits in the wild. The vulnerability requires user interaction and has a high attack complexity.

This vulnerability is fixed in python-utcp version 1.1.3. Users should upgrade to version 1.1.3 or later to remediate this issue. There is no official patch or temporary workaround detailed beyond upgrading. Since this is not a cloud service, remediation depends on applying the fixed version. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix in 1.1.3.