What is the CVSS score of CVE-2026-45370?

CVE-2026-45370 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of python-utcp are affected by CVE-2026-45370?

CVE-2026-45370 in python-utcp allows authenticated attackers to exfiltrate sensitive credentials (AWS keys, API tokens, database URLs) from process environment variables through a subprocess flaw.. A patch is available.

Is there a public PoC exploit available for CVE-2026-45370?

Yes, a public proof-of-concept exploit is available for CVE-2026-45370. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-45370?

Within 24 hours: inventory all deployments of python-utcp and identify instances accessible to LLM tools or low-privilege users. Within 7 days: upgrade python-utcp to version 1.1.2 or later (NVD references 1.1.3 as fixed) across all affected systems; validate environment variable isolation post-patch. Within 30 days: rotate all credentials that may have been exposed during the vulnerability window; enable credential scanning and implement principle-of-least-privilege for environment variable access in tool execution contexts.

python-utcp CVE-2026-45370

EUVD-2026-30477 HIGH

Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526)

2026-05-14 security-advisories@github.com

GHSA-5v57-8rxj-3p2r

Python Information Disclosure

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 14, 2026 - 22:05 vuln.today

Analysis Generated

May 14, 2026 - 22:05 vuln.today

Patch available

May 14, 2026 - 22:02 EUVD

CVE Published

May 14, 2026 - 21:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.

AnalysisAI

python-utcp CLI subprocess environment passes all process-level secrets to every tool call. When chained with CVE-2026-45369 command injection, remote authenticated attackers with low-privilege LLM tool access can exfiltrate AWS credentials, API keys, database URLs, and other environment variables in a single HTTP request. Patch available in version 1.1.2 (NVD references 1.1.3 as fixed version). GitHub security advisory confirms proof-of-concept demonstrating credential theft via env dump to attacker-controlled endpoint.

Technical ContextAI

python-utcp implements the Universal Tool Calling Protocol for AI agents to invoke CLI tools. The vulnerable _prepare_environment() function in cli_communication_protocol.py unconditionally copies os.environ to subprocess execution environments. This violates CWE-526 (Cleartext Storage of Sensitive Information in Environmental Variables) by exposing secrets like AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, DATABASE_URL, and ANTHROPIC_API_KEY to every subprocess. Unix process inheritance model normally restricts environment visibility, but this implementation actively propagates the full parent environment. The CVSS Changed Scope (S:C) reflects that secrets from the host process (one security authority) leak into attacker-controlled subprocess contexts (different authority). Python's os.environ.copy() returns a mutable dictionary, so this isn't a reference issue but deliberate full replication. The fix introduces an explicit allowlist model (PATH, HOME, LANG on Unix; PATH, SYSTEMROOT on Windows) with opt-in inheritance via CliCallTemplate.inherit_env_vars, shifting from implicit-unsafe to explicit-safe design.

RemediationAI

Upgrade utcp-cli to version 1.1.2 or later (note: NVD references 1.1.3 as fixed version - verify with vendor advisory at https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-5v57-8rxj-3p2r which confirms 1.1.2 contains the fix). Patch replaces os.environ.copy() with explicit allowlist model: default inherits only PATH/HOME/LANG (Unix) or PATH/SYSTEMROOT (Windows). Use CliCallTemplate.inherit_env_vars=[] for strict mode preventing all host environment inheritance. If immediate upgrade impossible, remove all sensitive credentials from process environment before starting python-utcp (store secrets in files with restricted permissions, key management services, or vaults). Trade-off: environment-based configuration is common in containerized deployments, so file-based secrets require application refactoring. Audit all CliCallTemplate definitions to ensure env_vars field contains only non-sensitive values. Block or heavily restrict access to CLI tool invocation endpoints if secrets cannot be removed from environment. This compensating control reduces attack surface but limits python-utcp functionality. Deploy network egress filtering to prevent subprocess HTTP callbacks, though sophisticated attackers can use DNS exfiltration or other covert channels.