{"id":"CVE-2026-45366","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T22:17:00.773","lastModified":"2026-07-21T10:10:00.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: \"http://127.0.0.1:9090\" }] or servers: [{ url: \"http://169.254.169.254\" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2."},{"lang":"es","value":"typescript-utcp es una implementación de UTCP en typescript. Antes de la versión 1.1.2, el paquete @utcp/http es vulnerable a una falsificación de petición del lado del servidor (SSRF) ciega causada por una inconsistencia en el límite de confianza entre el descubrimiento manual y la invocación de herramientas. registerManual() valida la URL de descubrimiento contra una lista de permitidos de HTTPS / loopback, pero callTool() reutiliza directamente la URL resuelta de toolCallTemplate.url sin revalidar, y el OpenApiConverter confía ciegamente en cualquier servers[0].url que declare una especificación alojada por un atacante. Un atacante que aloja una especificación OpenAPI maliciosa en un punto final HTTPS legítimo puede declarar, por ejemplo, servers: [{ url: 'http://127.0.0.1:9090' }] o servers: [{ url: 'http://169.254.169.254' }]; el conversor entonces produce herramientas cuya URL apunta a servicios internos en el host del agente. Esta vulnerabilidad se corrigió en la versión 1.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"universal-tool-calling-protocol","product":"typescript-utcp","versions":[{"version":"< 1.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-29T13:56:02.351079Z","id":"CVE-2026-45366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm","source":"security-advisories@github.com"}]}