EUVD-2026-36684
GHSA-vg9f-q4xh-62r4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege authentication; low C and I impact from internal resource access; no direct availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in python-utcp 1.1.0's utcp-gql and utcp-websocket components allows remote low-privileged attackers to coerce the server into issuing arbitrary outbound HTTP requests, potentially reaching internal infrastructure not exposed to the public internet. The affected library implements the universal-tool-calling-protocol and the vulnerable code paths reside in its GraphQL and WebSocket transport handlers. A public exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.
Technical ContextAI
python-utcp is a Python implementation of the universal-tool-calling-protocol (UTCP), a protocol for standardized tool invocation across AI and automation systems. The affected components - utcp-gql (GraphQL transport) and utcp-websocket (WebSocket transport) - handle endpoint URLs or connection targets that are user-influenced. CWE-918 (Server-Side Request Forgery) describes the root cause: the library fails to validate, restrict, or sanitize attacker-controlled URL inputs before the Python runtime performs outbound network connections on the server's behalf. This allows attackers to redirect the server to internal RFC-1918 addresses, cloud metadata endpoints (e.g., 169.254.169.254), or other network segments inaccessible from the public internet. The CPE string cpe:2.3:a:universal-tool-calling-protocol:python-utcp:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not yet constrained the affected range beyond the 1.1.0 version cited in the description.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the coordinated disclosure. Users should monitor the upstream repository at https://github.com/universal-tool-calling-protocol/python-utcp and the open GitHub issue #86 for any patch or release. As a compensating control, restrict outbound network egress from the host running python-utcp to only explicitly required external destinations using host-based firewall rules or a network egress proxy; this limits the reachable targets of a forged request but does not eliminate the vulnerability. Disable or gate access to the utcp-gql and utcp-websocket transport endpoints so that only explicitly trusted and authenticated principals can invoke them, reducing the exploitable attack surface. If cloud infrastructure is involved, block access to the instance metadata endpoint (e.g., 169.254.169.254) at the network or IAM level independently of the application. Organizations requiring this library should evaluate pinning to a patched release once one is available, or replacing the SSRF-prone transports with a hardened HTTP client that enforces an allowlist of permitted destination hosts.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today