Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

utcp-gql and utcp-websocket can be tricked into contacting attacker URLs

CVE-2026-101061 · published 22 days ago
Summary

Versions of utcp-gql and utcp-websocket older than 1.1.1 may let a malicious user supply specially crafted URLs that cause the server to make its own requests. This can expose internal services, cloud metadata, API keys and OAuth tokens to an attacker. Updating both components to version 1.1.1 or later removes the problem.

Original advisory text
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable...
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugin performs no URL validation despite documented security requirements. Attackers can force connections to internal services and cloud metadata endpoints by supplying malicious tool URLs in call templates, and receive configured API keys and OAuth tokens sent to attacker-controlled hosts.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-101061 · NVD
Track software like this
Free during beta