4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45366

CVE-2026-45366: typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45366

CVE-2026-45366:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@utcp/http	npm	<= 1.1.1	1.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the @utcp/http package, caused by a combination of insufficient URL validation and a failure to re-validate URLs at runtime. The registerManual functions across HttpCommunicationProtocol, SseCommunicationProtocol, and StreamableHttpCommunicationProtocol used a weak startsWith check for URL validation, which could be bypassed (e.g., http://localhost.evil.com). More critically, the HttpCommunicationProtocol.callTool function, which executes tool calls, did not perform any validation on the URL it was about to request. This URL was derived from an OpenAPI specification processed by OpenApiConverter.convert, which blindly trusted the servers[0].url field. This allowed an attacker to host a malicious OpenAPI specification on a legitimate HTTPS server, but with the servers[0].url pointing to an internal network address (e.g., http://169.254.169.254) or a loopback address. When the application would discover and then invoke this tool, the callTool function would make a request to the attacker-specified internal address, leading to SSRF. The patch rectifies this by introducing a robust, centralized URL validation helper (ensureSecureUrl) and applying it at two critical trust boundaries: during the initial manual discovery in all registerManual functions, and immediately before the HTTP request is made in callTool. Additionally, the OpenApiConverter was updated to prevent a remotely-hosted spec from declaring a loopback server, thus closing the loopback-redirect attack vector.

Vulnerable functions

HttpCommunicationProtocol.callTool

packages/http/src/http_communication_protocol.ts

This function was responsible for making the final HTTP request to execute a tool. Before the patch, it did not validate the URL it received, which was derived from an OpenAPI specification. An attacker could craft a malicious OpenAPI spec where the `servers[0].url` field points to an internal or loopback address. This function would then blindly make a request to that malicious URL, resulting in a Server-Side Request Forgery (SSRF).

OpenApiConverter.convert

packages/http/src/openapi_converter.ts

This function processes an OpenAPI specification and extracts the base URL for tool calls from the `servers[0].url` field. It blindly trusted this field, allowing an attacker to host a specification on a legitimate HTTPS server that points to an internal or loopback address. This created the malicious URL that would later be used by `HttpCommunicationProtocol.callTool`.

HttpCommunicationProtocol.registerManual

packages/http/src/http_communication_protocol.ts

This function, used for manual tool discovery, had a weak URL validation mechanism based on `startsWith`. This could be bypassed with URLs like `http://localhost.evil.com`, allowing a malicious discovery URL to pass the initial security check, contributing to the overall SSRF vulnerability.

SseCommunicationProtocol.registerManual

packages/http/src/sse_communication_protocol.ts

Similar to `HttpCommunicationProtocol.registerManual`, this function for the SSE protocol used the same flawed `startsWith` validation. This allowed a bypass of the security check intended to restrict discovery to secure URLs.

StreamableHttpCommunicationProtocol.registerManual

packages/http/src/streamable_http_communication_protocol.ts

This function for the streamable HTTP protocol also contained the weak `startsWith` URL validation. This vulnerability allowed an attacker to use a specially crafted URL to bypass the security check during the manual discovery phase.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.