CVE-2026-101057
Received Received - Intake

utcp-mcp MCP Server URL Connection Without HTTPS Validation

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensure_secure_url validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template naming a plain-HTTP, non-loopback MCP server URL is dialed as configured, exposing the MCP handshake to network interception and permitting cleartext connections to internal hosts. The mcpServers configuration is operator-authored rather than remote data, and the connection is an MCP handshake rather than an arbitrary request returning a body, which limits practical exploitation; the OAuth2 token_url credential path described in the original report was not reachable in the affected versions, because the OAuth2 handler was never invoked and the call template's auth field was not read. Fixed in utcp-mcp 1.1.3, which validates server URLs before any connection is made.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101057
EUVD
EUVD-2026-87982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
universal_tool_calling_protocol utcp-mcp to 1.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in utcp-mcp through version 1.1.2. It occurs because the plugin connects to HTTP and WebSocket MCP server URLs specified in a call template's mcpServers configuration without enforcing secure URL validation. This means HTTPS/WSS or loopback restrictions are not applied, allowing connections to plain HTTP or non-loopback servers. The MCP handshake could be intercepted over the network, exposing cleartext connections to internal hosts.

Detection Guidance

Check if utcp-mcp version is below 1.1.3. Inspect call templates for mcpServers configurations pointing to plain HTTP or non-loopback URLs. Monitor network traffic for unexpected connections to internal hosts over cleartext protocols.

Impact Analysis

The impact is limited but includes potential network interception of MCP handshakes and exposure of internal hosts via cleartext connections. The vulnerability requires operator-authored mcpServers configuration and user interaction. No credentials were exfiltrated in affected versions due to uninvoked OAuth2 handlers.

Compliance Impact

This vulnerability may lead to non-compliance with data protection regulations like GDPR or HIPAA due to potential exposure of sensitive data during cleartext MCP handshakes. Unauthorized network interception of internal communications could violate confidentiality requirements.

Mitigation Strategies

Upgrade utcp-mcp to version 1.1.3 or later. Review and update call templates to ensure mcpServers URLs enforce HTTPS/WSS or loopback restrictions. Disable plain HTTP MCP server connections if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart