{"data":{"id":"5db8684c-e24e-4885-9e7c-9e598126c8cd","title":"GHSA-r8j5-8747-88cm: @utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol","summary":"The @utcp/http npm package, versions 1.1.1 and earlier, contains a blind SSRF flaw in its manual discovery and tool invocation paths. The registerManual() check against an HTTPS/loopback allowlist is not reapplied in callTool(), and the OpenApiConverter trusts servers[0].url from an attacker-hosted OpenAPI spec, so an attacker can point generated tools at internal addresses such as http://169.254.169.254 or http://127.0.0.1:9090. The earlier startsWith('http://localhost') guard also let http://localhost.evil.com through.","solution":"Fixed in 1.1.2: callTool re-validates the resolved URL with ensureSecureUrl, and OpenApiConverter rejects a remote spec that declares a loopback servers[0].url. Workarounds for users who cannot upgrade immediately: refuse to call registerManual with any URL from an untrusted party, and restrict outbound network access from the agent host so RFC1918, 169.254.0.0/16 and loopback addresses are unreachable.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-r8j5-8747-88cm","publishedAt":"2026-05-14T20:55:05.000Z","cveId":"CVE-2026-45366","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@utcp/http@<= 1.1.1 (fixed: 1.1.2)"],"affectedPackageNames":["@utcp/http"],"affectedPackageRefs":["npm:@utcp/http"],"affectedVendors":[],"affectedVendorsRaw":["@utcp/http","Universal Tool Calling Protocol (UTCP)","OpenAPI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00122,"epssCheckedAt":"2026-11-07T00:12:14.870Z","kevDateAdded":null,"advisoryAliases":["GHSA-r8j5-8747-88cm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T20:55:05.000Z","fixReleasedAt":"2026-05-10T11:24:15.977Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:36:01.421Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@utcp/http","fixedVersion":"1.1.2","matchedVersion":"1.1.2","fixReleasedAt":"2026-05-10T11:24:15.977Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:36:01.273Z"}]}}