CVE-2026-101059
Received Received - Intake

OAuth2 Token Endpoint Redirection in utcp-http

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101059
EUVD
EUVD-2026-87984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
universal_tool_calling_protocol utcp-http to 1.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101059 is a Server-Side Request Forgery (SSRF) vulnerability in the utcp-http library versions before 1.1.4. It occurs because the library fails to validate the OAuth2 tokenUrl field in remote OpenAPI specifications. Attackers can exploit this by providing a malicious OpenAPI spec that redirects OAuth2 credential submissions to arbitrary endpoints. When a victim uses an OAuth2-protected tool generated from this spec, the library sends the victim's client_id and client_secret to the attacker-specified token endpoint without URL validation.

Detection Guidance

Check if your system uses utcp-http versions before 1.1.4 by running: pip show utcp-http. If installed, verify the version. Inspect OpenAPI specifications for untrusted tokenUrl fields in OAuth2 security schemes. Monitor network traffic for unexpected POST requests to external endpoints during OAuth2 flows.

Impact Analysis

This vulnerability allows attackers to steal sensitive OAuth2 credentials (client_id and client_secret) by tricking victims into using a malicious OpenAPI specification. The stolen credentials could then be used to gain unauthorized access to systems or data protected by OAuth2 authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive credentials, potentially violating data protection requirements under GDPR and HIPAA. Exposure of client_id and client_secret may result in unauthorized data access or processing, which is non-compliant with GDPR's principles of data protection and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade utcp-http to version 1.1.4 or later immediately. Disable OAuth2 tools generated from untrusted OpenAPI specs. Implement strict URL validation for all tokenUrl fields in OpenAPI specifications. Review and revoke any exposed client_id and client_secret credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart