python-utcp CVE-2026-101061

The application must use the utcp-gql (GraphQL) or utcp-websocket plugin at version <=1.1.0 and process a tool or manual call-template URL that the attacker can control (via register_manual or call_tool). For utcp-gql the attacker needs DNS control over an external domain so a bypass hostname (e.g. http://127.0.0.1.attacker.example or http://localhost.evil.com) satisfies the startswith prefix check and resolves to an internal/metadata address; utcp-websocket performs no URL validation at all, so any ws/wss URL works. Exploitation is limited by the need for the victim system to ingest the attacker-supplied URL (UI:P) and, for the GraphQL path, attacker-controlled DNS resolution (AC:H/AT:P). Impact is amplified only when auth headers (API keys/OAuth tokens) are configured on the call template.

This is a genuine but low-urgency SSRF (CWE-918). The vendor CVSS 4.0 score of 2.3 is deliberately low, driven by AC:H (the bypass requires the attacker to control DNS for a domain like attacker.example so a hostname such as http://127.0.0.1.attacker.example resolves to an internal target), AT:P (present attack requirement - a specific injectable call-template URL path), UI:P (the victim system must register/process the attacker-supplied tool or manual), and only Low confidentiality/integrity impact. No EPSS score is provided, there is no CISA KEV listing, and no public exploit was identified - so this is neither actively exploited nor widely automatable. The GHSA advisory contains detailed root-cause mechanics (exact vulnerable startswith check, file/line references) but not a packaged exploit. The signals are internally consistent: low CVSS, no KEV, no POC, niche product all point to a low real-world priority. The one factor that raises impact above pure blind SSRF is credential leakage: both plugins attach the call template's configured auth headers, so a forced outbound connection can exfiltrate API keys and OAuth tokens to an attacker-controlled host - worth patching promptly for anyone running these specific plugins.

An application built on python-utcp loads a tool manual or call template whose URL the attacker influences; using the GraphQL plugin the attacker supplies http://127.0.0.1.attacker.example/graphql (which passes the flawed startswith prefix check), or via the WebSocket plugin any URL (no validation at all). When the plugin connects, it targets internal services or cloud metadata (e.g. 169.254.169.254) and forwards the configured auth headers, leaking API keys and OAuth tokens to the attacker's host. No standalone public exploit exists, though the advisory documents the bypass mechanics in full.