# CVE-2026-12210: Universal Tool Calling Protocol SSRF via localhost validation bypass

Source: https://junglewise.ai/threats/cve-2026-12210-universal-tool-calling-protocol-ssrf-via-localhost-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12210 · Severity: medium · CVSS 6.3 · Published 2026-06-15

The utcp-gql and utcp-websocket plugins, which handle tool invocations over GraphQL and WebSocket respectively, fail to properly validate connection URLs before opening outbound connections. An attacker who can influence tool configuration can craft URLs with hostnames like `127.0.0.1.attacker.example` that bypass simplistic prefix checks (or perform no validation at all), forcing the client to make requests to internal services, cloud metadata endpoints, or attacker-controlled servers while automatically forwarding authentication credentials such as API keys or OAuth tokens.

Technologies: [Universal Tool Calling Protocol Python-Utcp](https://junglewise.ai/threats/technologies/python-utcp), [Universal Tool Calling Protocol Utcp-Gql](https://junglewise.ai/threats/technologies/utcp-gql), [Universal Tool Calling Protocol Utcp-Websocket](https://junglewise.ai/threats/technologies/utcp-websocket). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Universal Tool Calling Protocol](https://junglewise.ai/threats/vendors/universal-tool-calling-protocol).

## Quick answers

**Is CVE-2026-12210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12210 being exploited in the wild.

**How severe is CVE-2026-12210?** Medium severity, with a CVSS score of 6.3, published 15 June 2026.

**Which products and versions are affected?** utcp-gql (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1; utcp-websocket (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1; Universal Tool Calling Protocol Python-Utcp 1.1.0; Universal Tool Calling Protocol Utcp-Gql <= 1.1.0, 1.1.0; and 1 more.

**Is there a fix for CVE-2026-12210?** Yes. utcp-gql (PyPI): upgrade to 1.1.1 or later; utcp-websocket (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12210 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12210?** Check whether you run utcp-gql (PyPI), utcp-websocket (PyPI), Universal Tool Calling Protocol Python-Utcp or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- utcp-gql (PyPI): upgrade to 1.1.1 or later

  ```sh
  pip install "utcp-gql>=1.1.1"
  ```

- utcp-websocket (PyPI): upgrade to 1.1.1 or later

  ```sh
  pip install "utcp-websocket>=1.1.1"
  ```


## Technical details

Server-Side Request Forgery (SSRF / CWE-918) affecting two UTCP communication protocol plugins. The GraphQL plugin (`utcp-gql`) validates URLs using a flawed string prefix check: `url.startswith("http://localhost")` or `url.startswith("http://127.0.0.1")`. This allows bypass URLs such as `http://127.0.0.1.attacker.example/graphql` and `http://localhost.evil.com/graphql` to pass validation; if an attacker controls DNS for `attacker.example`, the hostname resolves to an arbitrary IP (including internal ranges like 192.168.x.x or metadata endpoints like 169.254.169.254). The WebSocket plugin (`utcp-websocket`) performs no hostname validation at all despite docstring claims of enforcing "WSS or localhost only"; any URL in a WebSocketCallTemplate connects without checks. Both plugins attach configured authentication headers (API key, Basic Auth, OAuth Bearer tokens) to all outbound connections, leaking credentials when the SSRF forces a connection to an attacker-controlled host. Attack requires the ability to influence tool manuals registered by a UTCP client. Fix: version 1.1.1 replaces prefix checks with proper hostname-based validation using `ensure_secure_url()` and introduces `ensure_secure_ws_url()` for WebSocket schemes; both also disable HTTP redirects (set `allow_redirects=False`) to prevent post-validation redirect SSRF.

## Affected products

- universal-tool-calling-protocol utcp-gql <= 1.1.0
- universal-tool-calling-protocol utcp-websocket <= 1.1.0

## Identifiers

- CVE-2026-12210
- GHSA-ppx3-28rw-8fpf
- PYSEC-2026-3931
- PYSEC-2026-3932

## Timeline

- 2026-06-14: disclosed: GitHub Advisory published (earlier disclosure date on record)
- 2026-08-25: advisory: Advisory updated with patch information
- 2026-08-25: patched: utcp-gql 1.1.1 and utcp-websocket 1.1.1 released with fixes

## References

- [https://api.github.com/users/hariantara](https://api.github.com/users/hariantara)
- [https://github.com/hariantara](https://github.com/hariantara)
- [https://api.github.com/users/hariantara/gists%7B/gist_id%7D](https://api.github.com/users/hariantara/gists%7B/gist_id%7D)
- [https://api.github.com/users/hariantara/repos](https://api.github.com/users/hariantara/repos)
- [https://avatars.githubusercontent.com/u/28644908?v=4](https://avatars.githubusercontent.com/u/28644908?v=4)
- [https://api.github.com/users/hariantara/events%7B/privacy%7D](https://api.github.com/users/hariantara/events%7B/privacy%7D)

## Related threats

- [utcp-gql and utcp-websocket server-side request forgery via URL validation bypass](https://junglewise.ai/threats/cve-2026-101061-utcp-gql-before-1-1-1-and-utcp-websocket-before-1-1-1-contain)
- [python-utcp server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-101060-python-utcp-versions-before-1-1-4-contain-a-server-side-request)
- [python-utcp server-side request forgery via remote HTTP manual](https://junglewise.ai/threats/cve-2026-101058-python-utcp-pip-package-utcp-http-before-1-1-12-does-not-verify)
- [python-utcp localhost prefix validation bypass in utcp-gql and utcp-websocket](https://junglewise.ai/threats/python-utcp-localhost-prefix-validation-bypass-in-utcp-gql-and-utcp-cca0bdf1)
- [python-utcp OS command injection in CLI communication protocol](https://junglewise.ai/threats/cve-2026-45369-python-utcp-os-command-injection-in-cli-communication-protocol)