Is CVE-2026-45366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45366 being exploited in the wild.

How severe is CVE-2026-45366?

Medium severity, with a CVSS score of 4.7, published 28 May 2026.

Which products and versions are affected?

@utcp/http (npm) <= 1.1.1, SEMVER:introduced=0,fixed=1.1.2; Universal Tool Calling Protocol HTTP <= 1.1.1.

Is there a fix for CVE-2026-45366?

Yes. @utcp/http (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45366 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45366?

Check whether you run @utcp/http (npm) or Universal Tool Calling Protocol HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45366: typescript-utcp SSRF in @utcp/http via OpenAPI spec redirection

Q: Which products and versions are affected?

@utcp/http (npm) <= 1.1.1, SEMVER:introduced=0,fixed=1.1.2; Universal Tool Calling Protocol HTTP <= 1.1.1.

Q: Is there a fix for CVE-2026-45366?

Yes. @utcp/http (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45366 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45366?

Check whether you run @utcp/http (npm) or Universal Tool Calling Protocol HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45366 · Severity: medium · CVSS 4.7 · Published 2026-05-28

The @utcp/http package, used for standardized communication between AI agents and web tools, is vulnerable to a flaw that allows an attacker to redirect the agent's requests to internal services. By providing a specially crafted tool specification, an attacker can trick the AI agent into scanning internal networks, accessing private cloud credentials, or interacting with unauthenticated local databases. This could lead to the exposure of sensitive infrastructure data or unauthorized access to internal management panels.

Vendors: npm, Universal Tool Calling Protocol.

Quick answers

Is CVE-2026-45366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45366 being exploited in the wild.
How severe is CVE-2026-45366?: Medium severity, with a CVSS score of 4.7, published 28 May 2026.
Which products and versions are affected?: @utcp/http (npm) <= 1.1.1, SEMVER:introduced=0,fixed=1.1.2; Universal Tool Calling Protocol HTTP <= 1.1.1.
Is there a fix for CVE-2026-45366?: Yes. @utcp/http (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45366 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45366?: Check whether you run @utcp/http (npm) or Universal Tool Calling Protocol HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@utcp/http (npm): upgrade to 1.1.2 or later
```
npm install @utcp/http@1.1.2
```

Technical details

A Server-Side Request Forgery (SSRF) exists in @utcp/http due to a trust-boundary inconsistency between the discovery and invocation phases. While registerManual() performs initial validation, callTool() reuses the resolved URL from the tool template without re-validation, and OpenApiConverter blindly trusts the 'servers[0].url' field in fetched specifications. An attacker can host a malicious OpenAPI spec on a legitimate HTTPS endpoint that points to internal addresses like 127.0.0.1 or 169.254.169.254. Additionally, a prefix-bypass flaw in the discovery check allowed URLs like 'http://localhost.evil.com' to pass. The vulnerability is patched in version 1.1.2 by implementing strict hostname-based validation and re-validating URLs immediately before request execution.

Affected products

universal-tool-calling-protocol @utcp/http <= 1.1.1

Identifiers

CVE-2026-45366
GHSA-r8j5-8747-88cm

Timeline

2026-05-10: disclosed: Initial disclosure on GitHub
2026-05-14: advisory: GitHub Advisory published
2026-05-28: kev added: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.