Universal-Tool-Calling-Protocol Python-Utcp
9 CVEs affecting Universal-Tool-Calling-Protocol Python-Utcp. Latest disclosed: 2026-09-27. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45369 | High | 8.3 | 2026-05-14 | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled too… |
CVE-2026-101060 | High | 8.2 | 2026-09-27 | python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool UR… |
CVE-2026-45370 | High | 7.7 | 2026-05-14 | python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to e… |
CVE-2026-101059 | High | 7.1 | 2026-09-27 | utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to… |
CVE-2026-101058 | Medium | 6.9 | 2026-09-27 | python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback in… |
CVE-2026-12210 | Medium | 6.3 | 2026-06-15 | A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. P… |
CVE-2026-101061 | Medium | 4.7 | 2026-09-27 | utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes… |
CVE-2026-44661 | Medium | 4.7 | 2026-05-14 | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a… |
CVE-2026-101057 | Low | 3.1 | 2026-09-27 | utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration w… |