GHSA-9qhg-99ww-9mqc: utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target

Summary

The utcp-http package's HttpCommunicationProtocol.call_tool validates only the initial tool URL, then issues the request with aiohttp's default allow_redirects=True and no per-hop revalidation. An attacker-controlled endpoint can return a 3xx redirect to an internal service, including the cloud metadata endpoint, and the response body is returned to the tool caller. The flaw bypasses the mitigation added in GHSA-39j6-4867-gg4w, which checked only the invocation-time URL.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database