CVE-2026-101061
Received Received - Intake

Server-Side Request Forgery in utcp-gql and utcp-websocket

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugin performs no URL validation despite documented security requirements. Attackers can force connections to internal services and cloud metadata endpoints by supplying malicious tool URLs in call templates, and receive configured API keys and OAuth tokens sent to attacker-controlled hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101061
EUVD
EUVD-2026-87986

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability affecting the GraphQL and WebSocket plugins of the python-utcp package. The issue occurs because fixes for a previous SSRF vulnerability (CVE-2026-44661) were not properly applied to these plugins. The GraphQL plugin uses an insecure URL validation method that attackers can bypass with URLs like http://127.0.0.1.attacker.example, while the WebSocket plugin has no URL validation at all.

Detection Guidance

Check if your system uses utcp-gql before 1.1.1 or utcp-websocket before 1.1.1 by running version checks like pip show utcp-gql or pip show utcp-websocket. Inspect network logs for unexpected outbound connections to internal services or cloud metadata endpoints. Monitor for unusual API key or OAuth token requests sent to external hosts.

Impact Analysis

Attackers can exploit this vulnerability to force connections to internal services or cloud metadata endpoints by supplying malicious tool URLs in call templates. This could lead to the leakage of sensitive credentials such as API keys and OAuth tokens sent to attacker-controlled hosts.

Compliance Impact

This vulnerability could lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive data such as API keys or OAuth tokens. Such data exposure may violate compliance requirements under GDPR (e.g., unauthorized data processing) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade utcp-gql to version 1.1.1 or higher and utcp-websocket to version 1.1.1 or higher immediately. Apply strict URL validation using the existing secure_url() helpers mentioned in the advisory. Disable or restrict GraphQL and WebSocket plugins if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart