CVE-2026-101060: python-utcp server-side request forgery via unvalidated HTTP redirects

CVE-2026-101060 · Severity: high · CVSS 8.2 · Published 2026-09-27

python-utcp is a protocol library used by AI agents to invoke remote tools over HTTP. The library validates that a tool's initial URL is safe but follows HTTP 302 redirects without re-validating the destination, allowing an attacker controlling a tool endpoint to redirect the client to internal services like cloud metadata endpoints or internal admin panels and exfiltrate their responses. This enables attackers to steal credentials, access internal data, or probe internal infrastructure.

Technologies: Universal Tool Calling Protocol Python-Utcp. Vendors: Universal Tool Calling Protocol.

Quick answers

Is CVE-2026-101060 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101060 being exploited in the wild.
How severe is CVE-2026-101060?
High severity, with a CVSS score of 8.2, published 27 September 2026.
Which products and versions are affected?
Universal Tool Calling Protocol Python-Utcp before 1.1.4.
Is there a fix for CVE-2026-101060?
A patch was published on 2026-06-14: Fix released in version 1.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101060 attacked?
It is attacked over the network.
Am I affected by CVE-2026-101060?
Check whether you run Universal Tool Calling Protocol Python-Utcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in HttpCommunicationProtocol.call_tool(), which calls ensure_secure_url() once before the HTTP request but then issues the request with aiohttp's default allow_redirects=True and performs no per-hop re-validation. An attacker controlling the tool's endpoint server can respond with a 302 redirect to an internal HTTP service (e.g., cloud metadata at 169.254.169.254, unauth internal datastores, or link-local endpoints); the library follows the redirect and returns the response body to the caller, bypassing the initial URL check. Exploitation requires either an attacker-influenced tool registration URL or a compromised legitimate tool endpoint, and an internal service reachable from the UTCP process that returns data on unauthenticated GET.

Affected products

  • universal-tool-calling-protocol python-utcp before 1.1.4

Timeline

  • 2026-06-14: disclosed: GitHub Security Advisory GHSA-9qhg-99ww-9mqc published
  • 2026-09-27: advisory: CVE-2026-101060 published on NVD
  • 2026-06-14: patched: Fix released in version 1.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.