utcp-mcp CVE-2026-101057

Requires TWO conditions to coincide: (1) an operator must author an mcpServers call-template entry naming a plain-HTTP or plain-WS, non-loopback MCP server URL (HTTPS/WSS and loopback are safe), and (2) an attacker must hold a man-in-the-middle position on the network path to that server to intercept or tamper with the cleartext MCP handshake. Limiting factors: the mcpServers config is operator-authored, not remote/attacker-controllable, so no URL injection is possible; the exposed channel is an MCP handshake, not an arbitrary request returning a response body; and the OAuth2 token_url credential-leak path is NOT reachable in affected versions. This is a client-side misconfiguration-plus-MITM condition, not remote unauthenticated exploitation against a default configuration.

This is a low-real-risk issue despite being a legitimate weakness. The vendor CVSS 4.0 base score is only 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:L, no integrity or availability impact), and the description itself explicitly downgrades the finding: the originally-reported OAuth2 token_url SSRF credential path was NOT reachable in affected versions because the OAuth2 handler was never invoked and the call template's auth field was never read. What remains is a cleartext-transmission flaw (CWE-319): utcp-mcp dials HTTP/WS MCP server URLs from the mcpServers config without the ensure_secure_url HTTPS/WSS-or-loopback check that sibling HTTP-family plugins enforce. Two structural facts sharply limit exploitation - the mcpServers configuration is operator-authored (not attacker-supplied remote data), so an attacker cannot inject a malicious URL, and the exposed traffic is an MCP handshake rather than an arbitrary request returning a body. Exploitation therefore requires both an operator misconfiguration (plain-HTTP non-loopback URL) and a network man-in-the-middle position (AC:H/AT:P). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data - no public exploit identified at time of analysis. The VulnCheck advisory slug labels this 'SSRF,' but the description makes clear the SSRF/credential-exfiltration path is not reachable; the real, confirmed impact is limited cleartext interception. Net: a valid hardening fix, not an urgent priority.

An operator configures utcp-mcp (≤1.1.2) with an mcpServers entry pointing at a plain-HTTP, non-loopback MCP server. An attacker positioned on the network path (e.g., shared LAN, compromised router, or between the client and an internal host) passively intercepts or actively tampers with the resulting cleartext MCP handshake. No public exploit code is identified; exploitation requires the man-in-the-middle position plus the pre-existing misconfiguration.