Vulnerability-Lookup

GHSA-PPX3-28RW-8FPF

Vulnerability from github – Published: 2026-08-25 15:52 – Updated: 2026-08-25 18:09

Summary

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

Details

Summary

The fix for CVE-2026-44661 (commit 5b16e43) added the ensure_secure_url() / is_secure_url() helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin (utcp-gql) still uses the startswith prefix check that the fix explicitly replaced, so http://127.0.0.1.attacker.example and http://localhost.evil.com pass it. The WebSocket plugin (utcp-websocket) performs no URL validation at all, even though its own docstrings state it enforces "WSS or localhost only." Both plugins reach the same SSRF that CVE-2026-44661 was filed for, and because both attach the call template's configured auth headers to the outbound connection, the SSRF can also leak API keys and OAuth tokens to an attacker-controlled host.

Details

In the CVE-2026-44661 fix (commit 5b16e43 ("fix(http): block SSRF via attacker-controlled OpenAPI servers[0].url")), two things in it pointed at sibling issues. The commit message says the change is "replacing the duplicated prefix check", and the new utcp_http/_security.py docstring names the exact bug:

URLs whose hostname starts with localhost / 127.0.0.1 but isn't actually loopback (e.g. http://localhost.evil.com, http://127.0.0.1.attacker.example). The earlier startswith check let these through.

The word "duplicated" says the vulnerable check existed in more than one place. The fix only updated the three HTTP-family plugins (http, streamable_http, sse). The other communication-protocol plugins were also inspected.

GraphQL plugin (utcp-gql). plugins/communication_protocols/gql/src/utcp_gql/gql_communication_protocol.py still has the pre-fix check at line 43:

def _enforce_https_or_localhost(self, url: str) -> None:
    if not (
        url.startswith("https://")
        or url.startswith("http://localhost")
        or url.startswith("http://127.0.0.1")
    ):
        raise ValueError("Security error: URL must use HTTPS or start with ...")

It is called on manual_call_template.url in register_manual (line 102) and on tool_call_template.url in call_tool (line 181). The URL then goes into AIOHTTPTransport(url=...) and a live GraphQL request.

"http://127.0.0.1.attacker.example/graphql".startswith("http://127.0.0.1") is True, so the check passes. If the attacker controls DNS for attacker.example, that hostname resolves to any address they choose, including 169.254.169.254, 127.0.0.1, or an internal 192.168.x.x host, and the GraphQL client sends a plain-HTTP request there. http://localhost.evil.com/graphql behaves the same way. This is the exact prefix bypass CVE-2026-44661 was filed for.

WebSocket plugin (utcp-websocket). plugins/communication_protocols/websocket/src/utcp_websocket/websocket_communication_protocol.py. The module and class docstrings state:

"Security enforcement (WSS or localhost only)" "Enforces security by requiring WSS or localhost connections" "Security validation of connection URLs"

There is no such validation in the code. _get_connection(), the only connection path (used by register_manual, call_tool, and call_tool_streaming), calls:

ws = await session.ws_connect(call_template.url, headers=headers, ...)   # line 197

with no scheme or host check. Any URL in a WebSocketCallTemplate connects, including ws://169.254.169.254/, ws://127.0.0.1:<internal-port>/, or any internal hostname.

Credential exposure. Both plugins build connection headers in _prepare_headers(), which attaches the configured auth: ApiKeyAuth as a header, BasicAuth as an Authorization: Basic header, and OAuth2Auth as an Authorization: Bearer token. When the bypass is used to force a plain-HTTP or plain-WS connection to an attacker-resolved host, those credentials are sent to the attacker.

This is the threat model CVE-2026-44661 already established: a UTCP client ingests tool manuals, and a malicious manual is attacker-influenced. The GraphQL and WebSocket plugins consume the same kind of call template, with the same url field, at the same trust level as the HTTP plugins that were fixed.

Affected packages: utcp-gql and utcp-websocket, both at the current release 1.1.0. Neither plugin has been modified since 2025-11-30, so both are unpatched on main.

PoC

The discrepancy is directly observable. With utcp-gql and utcp-http installed:

from utcp_gql.gql_communication_protocol import GraphQLCommunicationProtocol
from utcp_http._security import is_secure_url

bypass = "http://127.0.0.1.attacker.example/graphql"

# The fixed HTTP plugin rejects the bypass URL:
print("utcp_http is_secure_url:", is_secure_url(bypass))   # -> False

# The GraphQL plugin accepts it (no exception is raised):
GraphQLCommunicationProtocol()._enforce_https_or_localhost(bypass)
print("utcp_gql  _enforce_https_or_localhost: ACCEPTED")

End to end: a UTCP client that registers a manual declaring a GraphQL tool with url: "http://127.0.0.1.<attacker-domain>/graphql", where that domain resolves to an internal target, issues the request to that internal service. For WebSocket, a manual declaring a tool with url: "ws://169.254.169.254/" connects with no check at all. To confirm the request lands, point the URL at a listener you control on a host the client can reach but the attacker cannot, or at the client's own loopback.

Impact

Server-Side Request Forgery (CWE-918), the same class and trust boundary as CVE-2026-44661. An attacker who can get a UTCP client to register a malicious manual can:

Make the client send GraphQL requests (GraphQL plugin) or open WebSocket connections (WebSocket plugin) to internal services and cloud metadata endpoints it would not otherwise reach.
Force plain-HTTP / plain-WS connections to an attacker-resolved host, defeating the "HTTPS or loopback only" guarantee both plugins are meant to provide.
Receive the call template's configured credentials (API key, Basic auth, OAuth Bearer token), because those headers are attached to the forged request.

Suggested fix. The correct helper already exists in the codebase. Promote is_secure_url / ensure_secure_url from utcp_http into a shared module (or replicate the urlparse-based hostname logic), then replace _enforce_https_or_localhost in the GraphQL plugin with it, and add an equivalent check in the WebSocket plugin's _get_connection before ws_connect, adapted for the ws and wss schemes. This is the same centralization commit 5b16e43 already applied to the three HTTP plugins; it just needs to cover the remaining two transports.

Patched

utcp-gql 1.1.1 replaces the broken _enforce_https_or_localhost prefix check with hostname-based ensure_secure_url, applied at both register_manual and call_tool. The underlying aiohttp session is also patched after connect() to refuse 3xx responses, closing the post-validation redirect SSRF on the GraphQL endpoint.
utcp-websocket 1.1.1 introduces ensure_secure_ws_url (the WebSocket-scheme companion of ensure_secure_url) and enforces it in both the WebSocketCallTemplate Pydantic field validator and _get_connection. ws_connect is called with allow_redirects=False. The OAuth2 token-fetch path uses the same redirect-safe helper introduced in utcp-http 1.1.4.

Both plugins duplicate _security.py from utcp-http (rather than adding a cross-plugin runtime dependency); keep the copies in sync when changing validator behaviour.

Upgrade to utcp-gql >= 1.1.1 and/or utcp-websocket >= 1.1.1. No workaround in earlier versions.

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "utcp-gql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "utcp-websocket"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-12210"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:52:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe fix for CVE-2026-44661 (commit `5b16e43`) added the `ensure_secure_url()` / `is_secure_url()` helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin (`utcp-gql`) still uses the `startswith` prefix check that the fix explicitly replaced, so `http://127.0.0.1.attacker.example` and `http://localhost.evil.com` pass it. The WebSocket plugin (`utcp-websocket`) performs no URL validation at all, even though its own docstrings state it enforces \"WSS or localhost only.\" Both plugins reach the same SSRF that CVE-2026-44661 was filed for, and because both attach the call template\u0027s configured auth headers to the outbound connection, the SSRF can also leak API keys and OAuth tokens to an attacker-controlled host.\n\n### Details\n\nIn the CVE-2026-44661 fix (commit `5b16e43` (\"fix(http): block SSRF via attacker-controlled OpenAPI servers[0].url\")), two things in it pointed at sibling issues. The commit message says the change is \"replacing the duplicated prefix check\", and the new `utcp_http/_security.py` docstring names the exact bug:\n\n\u003e URLs whose hostname *starts* with `localhost` / `127.0.0.1` but isn\u0027t actually loopback (e.g. `http://localhost.evil.com`, `http://127.0.0.1.attacker.example`). The earlier `startswith` check let these through.\n\nThe word \"duplicated\" says the vulnerable check existed in more than one place. The fix only updated the three HTTP-family plugins (`http`, `streamable_http`, `sse`). The other communication-protocol plugins were also inspected.\n\n**GraphQL plugin (`utcp-gql`).** `plugins/communication_protocols/gql/src/utcp_gql/gql_communication_protocol.py` still has the pre-fix check at line 43:\n\n```python\ndef _enforce_https_or_localhost(self, url: str) -\u003e None:\n    if not (\n        url.startswith(\"https://\")\n        or url.startswith(\"http://localhost\")\n        or url.startswith(\"http://127.0.0.1\")\n    ):\n        raise ValueError(\"Security error: URL must use HTTPS or start with ...\")\n```\n\nIt is called on `manual_call_template.url` in `register_manual` (line 102) and on `tool_call_template.url` in `call_tool` (line 181). The URL then goes into `AIOHTTPTransport(url=...)` and a live GraphQL request.\n\n`\"http://127.0.0.1.attacker.example/graphql\".startswith(\"http://127.0.0.1\")` is `True`, so the check passes. If the attacker controls DNS for `attacker.example`, that hostname resolves to any address they choose, including `169.254.169.254`, `127.0.0.1`, or an internal `192.168.x.x` host, and the GraphQL client sends a plain-HTTP request there. `http://localhost.evil.com/graphql` behaves the same way. This is the exact prefix bypass CVE-2026-44661 was filed for.\n\n**WebSocket plugin (`utcp-websocket`).** `plugins/communication_protocols/websocket/src/utcp_websocket/websocket_communication_protocol.py`. The module and class docstrings state:\n\n\u003e \"Security enforcement (WSS or localhost only)\"\n\u003e \"Enforces security by requiring WSS or localhost connections\"\n\u003e \"Security validation of connection URLs\"\n\nThere is no such validation in the code. `_get_connection()`, the only connection path (used by `register_manual`, `call_tool`, and `call_tool_streaming`), calls:\n\n```python\nws = await session.ws_connect(call_template.url, headers=headers, ...)   # line 197\n```\n\nwith no scheme or host check. Any URL in a `WebSocketCallTemplate` connects, including `ws://169.254.169.254/`, `ws://127.0.0.1:\u003cinternal-port\u003e/`, or any internal hostname.\n\n**Credential exposure.** Both plugins build connection headers in `_prepare_headers()`, which attaches the configured auth: `ApiKeyAuth` as a header, `BasicAuth` as an `Authorization: Basic` header, and `OAuth2Auth` as an `Authorization: Bearer` token. When the bypass is used to force a plain-HTTP or plain-WS connection to an attacker-resolved host, those credentials are sent to the attacker.\n\nThis is the threat model CVE-2026-44661 already established: a UTCP client ingests tool manuals, and a malicious manual is attacker-influenced. The GraphQL and WebSocket plugins consume the same kind of call template, with the same `url` field, at the same trust level as the HTTP plugins that were fixed.\n\nAffected packages: `utcp-gql` and `utcp-websocket`, both at the current release `1.1.0`. Neither plugin has been modified since 2025-11-30, so both are unpatched on `main`.\n\n### PoC\n\nThe discrepancy is directly observable. With `utcp-gql` and `utcp-http` installed:\n\n```python\nfrom utcp_gql.gql_communication_protocol import GraphQLCommunicationProtocol\nfrom utcp_http._security import is_secure_url\n\nbypass = \"http://127.0.0.1.attacker.example/graphql\"\n\n# The fixed HTTP plugin rejects the bypass URL:\nprint(\"utcp_http is_secure_url:\", is_secure_url(bypass))   # -\u003e False\n\n# The GraphQL plugin accepts it (no exception is raised):\nGraphQLCommunicationProtocol()._enforce_https_or_localhost(bypass)\nprint(\"utcp_gql  _enforce_https_or_localhost: ACCEPTED\")\n```\n\nEnd to end: a UTCP client that registers a manual declaring a GraphQL tool with `url: \"http://127.0.0.1.\u003cattacker-domain\u003e/graphql\"`, where that domain resolves to an internal target, issues the request to that internal service. For WebSocket, a manual declaring a tool with `url: \"ws://169.254.169.254/\"` connects with no check at all. To confirm the request lands, point the URL at a listener you control on a host the client can reach but the attacker cannot, or at the client\u0027s own loopback.\n\n### Impact\n\nServer-Side Request Forgery (CWE-918), the same class and trust boundary as CVE-2026-44661. An attacker who can get a UTCP client to register a malicious manual can:\n\n- Make the client send GraphQL requests (GraphQL plugin) or open WebSocket connections (WebSocket plugin) to internal services and cloud metadata endpoints it would not otherwise reach.\n- Force plain-HTTP / plain-WS connections to an attacker-resolved host, defeating the \"HTTPS or loopback only\" guarantee both plugins are meant to provide.\n- Receive the call template\u0027s configured credentials (API key, Basic auth, OAuth Bearer token), because those headers are attached to the forged request.\n\nSuggested fix. The correct helper already exists in the codebase. Promote `is_secure_url` / `ensure_secure_url` from `utcp_http` into a shared module (or replicate the `urlparse`-based hostname logic), then replace `_enforce_https_or_localhost` in the GraphQL plugin with it, and add an equivalent check in the WebSocket plugin\u0027s `_get_connection` before `ws_connect`, adapted for the `ws` and `wss` schemes. This is the same centralization commit `5b16e43` already applied to the three HTTP plugins; it just needs to cover the remaining two transports.\n\n## Patched\n\n- `utcp-gql` 1.1.1 replaces the broken `_enforce_https_or_localhost`\n  prefix check with hostname-based `ensure_secure_url`, applied at\n  both `register_manual` and `call_tool`. The underlying aiohttp\n  session is also patched after `connect()` to refuse 3xx responses,\n  closing the post-validation redirect SSRF on the GraphQL endpoint.\n- `utcp-websocket` 1.1.1 introduces `ensure_secure_ws_url` (the\n  WebSocket-scheme companion of `ensure_secure_url`) and enforces it\n  in both the `WebSocketCallTemplate` Pydantic field validator and\n  `_get_connection`. `ws_connect` is called with `allow_redirects=False`.\n  The OAuth2 token-fetch path uses the same redirect-safe helper\n  introduced in `utcp-http` 1.1.4.\n\nBoth plugins duplicate `_security.py` from `utcp-http` (rather than\nadding a cross-plugin runtime dependency); keep the copies in sync\nwhen changing validator behaviour.\n\nUpgrade to `utcp-gql \u003e= 1.1.1` and/or `utcp-websocket \u003e= 1.1.1`. No\nworkaround in earlier versions.",
  "id": "GHSA-ppx3-28rw-8fpf",
  "modified": "2026-08-25T18:09:41Z",
  "published": "2026-08-25T15:52:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-ppx3-28rw-8fpf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12210"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gola-leya/cve_submit/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp/issues/86"
    },
    {
      "type": "WEB",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp/commit/fc3268e2a62e1181f91a63faf0a9bcee7639db29"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-12210"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/832542"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/370852"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins"
}

CVE-2026-12210 (GCVE-0-2026-12210)

Vulnerability from cvelistv5 – Published: 2026-06-15 02:30 – Updated: 2026-06-15 13:19

Title

universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery

Summary

A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-15 13:19 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

7 references

URL	Tags
https://vuldb.com/vuln/370852	vdb-entry
https://vuldb.com/vuln/370852/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-12210	third-party-advisory
https://vuldb.com/submit/832542	third-party-advisory
https://github.com/universal-tool-calling-protoco…	issue-tracking
https://github.com/gola-leya/cve_submit/issues/1	exploitissue-tracking
https://github.com/universal-tool-calling-protoco…	product

Impacted products

1 product

Vendor	Product	Version
universal-tool-calling-protocol	python-utcp	Affected: 1.1.0 cpe:2.3:a:universal-tool-calling-protocol:python-utcp::::::::

Credits

gola (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12210",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T13:19:45.321990Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T13:19:52.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:universal-tool-calling-protocol:python-utcp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "utcp-gql/utcp-websocket"
          ],
          "product": "python-utcp",
          "vendor": "universal-tool-calling-protocol",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "gola (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T02:30:10.150Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-370852 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/370852"
        },
        {
          "name": "VDB-370852 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/370852/cti"
        },
        {
          "name": "CVE-2026-12210 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-12210"
        },
        {
          "name": "Submit #832542 | universal-tool-calling-protocol python-utcp 1.1.0 Improper Input Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/832542"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/universal-tool-calling-protocol/python-utcp/issues/86"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/gola-leya/cve_submit/issues/1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/universal-tool-calling-protocol/python-utcp/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-14T14:35:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-12210",
    "datePublished": "2026-06-15T02:30:10.150Z",
    "dateReserved": "2026-06-14T12:30:06.444Z",
    "dateUpdated": "2026-06-15T13:19:52.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-PPX3-28RW-8FPF

Summary

Details

PoC

Impact

Patched

CVE-2026-12210 (GCVE-0-2026-12210)

Tags

Sightings

Nomenclature