CVE-2026-101061

Katalog CVE

CVSS 4.7 · Medium EPSS 0,20%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 4.7 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugin performs no URL validation despite documented security requirements. Attackers can force connections to internal services and cloud metadata endpoints by supplying malicious tool URLs in call templates, and receive configured API keys and OAuth tokens sent to attacker-controlled hosts.

Rincian

Terbit di NVD

27 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-ppx3-28rw-8fpf
• https://www.vulncheck.com/advisories/utcp-gql-and-utcp-websocket-before-1.1.1-ssrf-via-url-validation-bypass