→

CVE-2026-44661: python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44661

CVE-2026-44661:

4.7

CVSS Score

3.1

-

CVSS Score

-

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
utcp-http	pip	<= 1.1.1	1.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the utcp-http library, affecting multiple communication protocols (http, streamable_http, sse). The root cause is a trust boundary violation. The register_manual function performs an initial, albeit flawed, security check on a URL used to discover tools from an OpenAPI specification. However, the call_tool and call_tool_streaming functions would later use the servers[0].url value from the fetched OpenAPI specification without any further validation. An attacker could host a malicious OpenAPI spec on a seemingly safe HTTPS URL. This spec could then specify an internal or cloud-metadata URL (e.g., http://169.254.169.254) in its servers field. When the agent invokes a tool from this spec, the call_tool or call_tool_streaming function would make a request to this internal URL, leading to a blind SSRF. This could be used to exfiltrate cloud credentials, scan internal networks, or access sensitive internal services. The patch addresses this by introducing and applying a strict ensure_secure_url check at two critical points: during the initial manual registration (fixing a startswith bypass) and, most importantly, immediately before the HTTP request is made in the call_tool and call_tool_streaming functions, thus closing the SSRF loophole.

Vulnerable functions

HttpCommunicationProtocol.call_tool

plugins/communication_protocols/http/src/utcp_http/http_communication_protocol.py

This function was vulnerable to a blind Server-Side Request Forgery (SSRF). It used a URL from a `tool_call_template` without re-validating it before making an HTTP request. An attacker could provide a malicious OpenAPI specification with a URL pointing to an internal service. When this tool was called, the function would make a request to the malicious URL, allowing the attacker to access internal resources.

HttpCommunicationProtocol.register_manual

plugins/communication_protocols/http/src/utcp_http/http_communication_protocol.py

This function used a weak `startswith` check to validate URLs, which could be bypassed (e.g., `http://localhost.evil.com`). This allowed the registration of tools from malicious URLs, which is a contributing factor to the main SSRF vulnerability in `call_tool`.

SseCommunicationProtocol.call_tool_streaming

plugins/communication_protocols/http/src/utcp_http/sse_communication_protocol.py

This function was vulnerable to a blind Server-Side Request Forgery (SSRF). It used a URL from a `tool_call_template` without re-validating it before making an HTTP request. An attacker could provide a malicious OpenAPI specification with a URL pointing to an internal service. When this tool was called, the function would make a request to the malicious URL, allowing the attacker to access internal resources.

SseCommunicationProtocol.register_manual

plugins/communication_protocols/http/src/utcp_http/sse_communication_protocol.py

This function used a weak `startswith` check to validate URLs, which could be bypassed (e.g., `http://localhost.evil.com`). This allowed the registration of tools from malicious URLs, which is a contributing factor to the main SSRF vulnerability in `call_tool_streaming`.

StreamableHttpCommunicationProtocol.call_tool_streaming

plugins/communication_protocols/http/src/utcp_http/streamable_http_communication_protocol.py

This function was vulnerable to a blind Server-Side Request Forgery (SSRF). It used a URL from a `tool_call_template` without re-validating it before making an HTTP request. An attacker could provide a malicious OpenAPI specification with a URL pointing to an internal service. When this tool was called, the function would make a request to the malicious URL, allowing the attacker to access internal resources.

StreamableHttpCommunicationProtocol.register_manual

plugins/communication_protocols/http/src/utcp_http/streamable_http_communication_protocol.py

This function used a weak `startswith` check to validate URLs, which could be bypassed (e.g., `http://localhost.evil.com`). This allowed the registration of tools from malicious URLs, which is a contributing factor to the main SSRF vulnerability in `call_tool_streaming`.

Vulnerability Intelligence
Miggo AI

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44661: python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

CVE-2026-44661:

4.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-44661: python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

4.7

4.7

4.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44661: python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

CVE-2026-44661:

4.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-44661: python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

4.7

4.7

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI