CVE-2026-101061: utcp-gql and utcp-websocket SSRF Vulnerability

CVE-2026-101061 Overview

CVE-2026-101061 is a server-side request forgery (SSRF) vulnerability affecting utcp-gql and utcp-websocket plugins before version 1.1.1 in the Universal Tool Calling Protocol (UTCP) Python implementation. The flaw stems from incomplete remediation of CVE-2026-44661. The GraphQL plugin applies a weak prefix-based URL check that attackers bypass with hostnames such as http://127.0.0.1.attacker.example, while the WebSocket plugin performs no URL validation at all. Attackers supplying malicious tool URLs in call templates can force connections to internal services and cloud metadata endpoints and exfiltrate configured API keys and OAuth tokens.

Critical Impact
Attackers can coerce the UTCP client into connecting to internal services or cloud metadata endpoints and leak API keys and OAuth tokens to attacker-controlled hosts.

Affected Products

utcp-gql (Python UTCP GraphQL plugin) before 1.1.1
utcp-websocket (Python UTCP WebSocket plugin) before 1.1.1
Universal Tool Calling Protocol Python reference implementation (python-utcp)

Discovery Timeline

2026-09-27 - CVE-2026-101061 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101061

Vulnerability Analysis

The vulnerability is categorized as Server-Side Request Forgery [CWE-918]. UTCP call templates let callers specify the endpoint used to reach a tool. Both affected plugins consume that URL and open a network connection without validating the resolved destination.

The GraphQL plugin attempts to block loopback and private-range targets using a prefix string comparison. The check matches text at the start of the URL rather than parsing the host component. An attacker supplies a URL whose host begins with a blocked literal but resolves to an attacker-controlled address, for example http://127.0.0.1.attacker.example/graphql. The prefix matcher sees 127.0.0.1 and accepts the URL. DNS resolution then returns the attacker's public IP, and the client issues the GraphQL request there along with any configured credentials.

The WebSocket plugin omits URL validation entirely despite documented security requirements. Any ws:// or wss:// URL supplied in a call template is dialed directly. Configured headers, API keys, and OAuth bearer tokens are transmitted to whichever host the attacker selects.

Root Cause

The root cause is incomplete remediation of the earlier CVE-2026-44661 fixes. The GraphQL plugin relies on string-prefix matching instead of parsing the URL, resolving the host, and comparing the resulting IP address against deny lists. The WebSocket plugin never implements the validation that its documentation asserts.

Attack Vector

Exploitation requires an attacker to influence the tool URL used in a UTCP call template. The attacker crafts a URL that satisfies the broken validator or targets the unvalidated WebSocket path. The UTCP client then connects to the attacker's host or to an internal resource such as http://169.254.169.254/latest/meta-data/ on AWS, returning cloud instance credentials or forwarding configured secrets.

No exploitation code is published alongside the advisory. Refer to the GitHub Security Advisory GHSA-ppx3-28rw-8fpf and the VulnCheck Advisory for SSRF for the authoritative technical description.

Detection Methods for CVE-2026-101061

Indicators of Compromise

Outbound HTTP, HTTPS, ws://, or wss:// connections from UTCP-enabled hosts to cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or 100.100.100.200.
UTCP call templates containing hostnames with embedded private IP literals followed by attacker-controlled suffixes, for example 127.0.0.1.attacker.example or localhost.evil.tld.
Unexpected GraphQL or WebSocket connections from application workloads to internet destinations not present in prior baselines.

Detection Strategies

Inspect UTCP configuration stores and call-template repositories for URLs whose hostnames contain multiple private-range literals or unusual suffix chains.
Correlate egress proxy logs with the UTCP process identity to surface GraphQL and WebSocket connections initiated by utcp-gql or utcp-websocket.
Alert on any UTCP-origin request carrying Authorization or X-Api-Key headers to a destination outside an approved tool allowlist.

Monitoring Recommendations

Enable DNS query logging on hosts running the UTCP Python client and alert on resolutions returning public IP addresses for hostnames prefixed with reserved IP literals.
Monitor metadata-service IPs for connections sourced from application tiers that have no legitimate need to query them.
Track installed utcp-gql and utcp-websocket package versions in software bills of materials and flag any instance below 1.1.1.

How to Mitigate CVE-2026-101061

Immediate Actions Required

Upgrade utcp-gql and utcp-websocket to version 1.1.1 or later across all Python environments.
Audit stored UTCP call templates and reject templates whose tool URLs are not on an explicit allowlist.
Rotate any API keys, OAuth tokens, and cloud credentials that were configured in UTCP call templates before patching.

Patch Information

Fixed versions are utcp-gql 1.1.1 and utcp-websocket 1.1.1. Patch details are published in the GitHub Security Advisory GHSA-ppx3-28rw-8fpf. The VulnCheck Advisory for SSRF documents the validation bypass that the update closes.

Workarounds

Route outbound UTCP traffic through an egress proxy that blocks link-local, loopback, and RFC1918 destinations and rejects hostnames resolving to those ranges.
Attach instance metadata service protections such as IMDSv2 enforcement on AWS and restrict metadata endpoint access to specific workloads.
Validate tool URLs at the application layer by parsing the host, resolving it, and comparing the resulting IP against deny lists before invoking the plugin.

bash

# Configuration example
pip install --upgrade 'utcp-gql>=1.1.1' 'utcp-websocket>=1.1.1'
pip show utcp-gql utcp-websocket | grep -E 'Name|Version'