CVE-2026-101061 is a server-side request forgery (SSRF) vulnerability affecting the universal-tool-calling-protocol python-utcp versions before 1.1.1. The flaw exists because the GraphQL plugin's prefix check can be bypassed with crafted URLs, and the WebSocket plugin lacks URL validation. This allows attackers to make the server connect to internal services or cloud metadata endpoints and potentially exfiltrate sensitive API keys and OAuth tokens. The vulnerability has a low CVSS score of 2.3 and requires user interaction and high attack complexity.
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.
CVE-2026-101057 is a vulnerability in the utcp-mcp plugin of python-utcp up to version 1.1.2 where it connects to HTTP and WebSocket MCP server URLs without enforcing secure URL validation. This allows cleartext transmission of the MCP handshake to non-secure HTTP servers, potentially exposing sensitive information to network interception. The vulnerability is limited by the fact that the server URLs are operator-configured and the OAuth2 authentication path is not invoked in affected versions. The issue is fixed in version 1.1.3 by validating server URLs before connection.
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-45369 is an OS command injection vulnerability in the python-utcp package prior to version 1.1.3. The vulnerability arises because the _substitute_utcp_args method inserts user-controlled input directly into shell command strings without sanitization, which are then executed by the system shell. This allows an attacker to inject arbitrary commands. The vulnerability has a high severity with a CVSS score of 8.3. A fix is available in version 1.1.3.
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation.register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g.servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.
The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual (e.g., one defining an HTTP tool call), earning the clients’ trust, a malicious provider can later change the manual to exploit the client.