GHSA-r8j5-8747-88cm: @utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary

The @utcp/http npm package, versions 1.1.1 and earlier, contains a blind SSRF flaw in its manual discovery and tool invocation paths. The registerManual() check against an HTTPS/loopback allowlist is not reapplied in callTool(), and the OpenApiConverter trusts servers[0].url from an attacker-hosted OpenAPI spec, so an attacker can point generated tools at internal addresses such as http://169.254.169.254 or http://127.0.0.1:9090. The earlier startsWith('http://localhost') guard also let http://localhost.evil.com through.

Mitigation

Fixed in 1.1.2: callTool re-validates the resolved URL with ensureSecureUrl, and OpenApiConverter rejects a remote spec that declares a loopback servers[0].url. Workarounds for users who cannot upgrade immediately: refuse to call registerManual with any URL from an untrusted party, and restrict outbound network access from the agent host so RFC1918, 169.254.0.0/16 and loopback addresses are unreachable.

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek