universal-tool-calling-protocol python-utcp

5 known vulnerabilities in universal-tool-calling-protocol python-utcp, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

CVE-2026-101061 CVSS 2.3 low utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of…
CVE-2026-101060 CVSS 8.4 high python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that…
CVE-2026-101059 CVSS 7.1 high utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect…
CVE-2026-101058 CVSS 7.1 high python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the…
CVE-2026-101057 CVSS 2.3 low utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's…