Executive brief
The python-utcp library provides GraphQL and WebSocket communication plugins for AI agents. A validation flaw allows attackers to bypass localhost-only security checks by crafting URLs with attacker domains that begin with "127.0.0.1" or "localhost" prefixes (e.g., "127.0.0.1.attacker.com"). This enables authenticated API requests to be sent to remote attacker-controlled servers, potentially exposing authorization headers, API keys, and sensitive tool-call data.
Technical details
This vulnerability is a server-side request forgery (SSRF) caused by improper hostname validation in the GraphQLCommunicationProtocol._enforce_https_or_localhost() and WebSocketCallTemplate.validate_url() methods. The affected components use string prefix matching instead of parsing and validating the actual hostname, allowing URLs such as "http://127.0.0.1.attacker.com" or "http://127.0.0.1.x.x.x.sslip.io" to pass localhost validation despite resolving to remote servers. The attack requires influence over endpoint URL configuration or the ability to control which URL is used for connections. An authenticated attacker can exploit this to redirect requests to attacker infrastructure and harvest sensitive data like authorization headers, API keys, and tool-call payloads. No patched version is currently available.
Affected products
- universal-tool-calling-protocol utcp-gql <= 1.1.0
- universal-tool-calling-protocol utcp-websocket <= 1.1.0
- universal-tool-calling-protocol python-utcp 1.1.0
Timeline
- 2026-06-08: disclosed: Vulnerability reported via GitHub issue #86
- 2026-06-15: advisory: GHSA-vg9f-q4xh-62r4 published; duplicate advisory withdrawn on 2026-08-25