Executive brief
The @utcp/http package, used for standardized communication between AI agents and web tools, is vulnerable to a flaw that allows an attacker to redirect the agent's requests to internal services. By providing a specially crafted tool specification, an attacker can trick the AI agent into scanning internal networks, accessing private cloud credentials, or interacting with unauthenticated local databases. This could lead to the exposure of sensitive infrastructure data or unauthorized access to internal management panels.
Technical details
A Server-Side Request Forgery (SSRF) exists in @utcp/http due to a trust-boundary inconsistency between the discovery and invocation phases. While registerManual() performs initial validation, callTool() reuses the resolved URL from the tool template without re-validation, and OpenApiConverter blindly trusts the 'servers[0].url' field in fetched specifications. An attacker can host a malicious OpenAPI spec on a legitimate HTTPS endpoint that points to internal addresses like 127.0.0.1 or 169.254.169.254. Additionally, a prefix-bypass flaw in the discovery check allowed URLs like 'http://localhost.evil.com' to pass. The vulnerability is patched in version 1.1.2 by implementing strict hostname-based validation and re-validating URLs immediately before request execution.
Affected products
- universal-tool-calling-protocol @utcp/http <= 1.1.1
Timeline
- 2026-05-10: disclosed: Initial disclosure on GitHub
- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: kev added: NVD publication date