Executive brief
The utcp-http plugin, used for connecting AI agents to web services, contains a vulnerability that allows an attacker to trick the agent into making unauthorized requests to internal systems. By providing a specially crafted service specification, an attacker can bypass security checks to access sensitive internal data, such as cloud credentials or private administrative panels. This could lead to the exposure of confidential infrastructure information or unauthorized access to internal-only services.
Technical details
A blind Server-Side Request Forgery (SSRF) exists in utcp-http due to a trust-boundary inconsistency. While the initial discovery URL is validated, the 'call_tool' and 'call_tool_streaming' functions reuse the resolved URL from the OpenAPI specification without re-validation. An attacker can host a malicious OpenAPI spec on a legitimate HTTPS endpoint that defines internal or loopback addresses (e.g., 169.254.169.254 or 127.0.0.1) in the 'servers' field. Additionally, a prefix-based validation bypass allowed hostnames like 'localhost.evil.com'. Version 1.1.2 provided a partial fix by blocking non-loopback internal IPs, but version 1.1.3 is required to fully prevent remote specifications from targeting the local loopback interface.
Affected products
- universal-tool-calling-protocol utcp-http <= 1.1.2
Timeline
- 2026-05-03: disclosed
- 2026-05-07: advisory
- 2026-05-14: patched: Full fix released in version 1.1.3