PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-101057 universal-tool-calling-protocol CVE debrief

The CVE-2026-101057 vulnerability in the utcp-mcp plugin of python-utcp allows for SSRF via unvalidated MCP server URLs. This issue arises because the plugin connects to HTTP and WebSocket MCP server URLs without ensuring they are secure, as required by the HTTPS/WSS-or-loopback rule. The vulnerability is limited by the fact that the mcpServers configuration is operator-authored and the connection is an MCP handshake rather than an arbitrary request. The issue was fixed in utcp-mcp version 1.1.3, which validates server URLs before making connections.

Vendor
universal-tool-calling-protocol
Product
python-utcp
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-27
Original CVE updated
2026-09-27
Advisory published
2026-09-27
Advisory updated
2026-09-27

Who should care

Defenders and operators using the utcp-mcp plugin, especially those configuring MCP server URLs, should assess their exposure and verify the use of secure protocols for MCP connections. This involves reviewing current configurations, updating to version 1.1.3 or later, and validating MCP server URLs.

Why it matters

CVE-2026-101057 is a vulnerability in the utcp-mcp plugin of python-utcp that allows for SSRF via unvalidated MCP server URLs. Defenders should care because it exposes the MCP handshake to potential network interception and SSRF attacks. The vulnerability is limited by operator-authored configurations and the nature of MCP handshakes. Remediation involves updating to version 1.1.3 and validating MCP server URLs.

  • Potential exposure of MCP handshakes to network interception
  • Risk of SSRF attacks through unvalidated MCP server URLs
  • Need for verification of MCP server URL validation in utcp-mcp configurations
  • Importance of updating to utcp-mcp version 1.1.3 or later for secure connections

Technical summary

The utcp-mcp plugin of python-utcp is vulnerable to Server-Side Request Forgery (SSRF) due to unvalidated MCP server URLs. This allows an operator to potentially expose the MCP handshake to network interception by specifying a plain-HTTP, non-loopback MCP server URL in the call template's mcpServers configuration. The issue is addressed in utcp-mcp version 1.1.3, which introduces validation for server URLs before connections are made.

Defensive priority

Defenders should prioritize verifying the use of utcp-mcp version 1.1.3 or later, especially in environments where MCP server URLs are configured by operators. They should also review and validate MCP server URLs to ensure they use secure protocols.

Recommended defensive actions

  • Verify and update utcp-mcp to version 1.1.3 or later
  • Review and validate MCP server URLs for secure protocols
  • Monitor for potential SSRF attempts in network traffic
  • Perform a thorough review of current MCP server URL configurations
  • Implement additional monitoring for network traffic related to MCP connections
  • Conduct regular security audits to ensure compliance with secure protocols
  • Document and track changes to MCP server URL configurations

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. Additional information is provided by source references from [email protected] regarding the vulnerability in utcp-mcp before version 1.1.3.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-101057 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-101057

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-101057 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-101057

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.