MEDIUM 4.7 GitHub
CVE-2026-12210
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
### Summary
The fix for CVE-2026-44661 (commit `5b16e43`) added the `ensure_secure_url()` / `is_secure_url()` helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin (`utcp-gql`) still uses the `startswith` prefix check that the fix explicitly replaced, so `http://127.0.0.1.attacker.example` and `http://localhost.evil.com` pass it. The WebSocket plugin (`utcp-websocket`) performs no URL validation at all, even though i
Affected Products
- pip/utcp-gql <= 1.1.0
- pip/utcp-websocket <= 1.1.0
References
- https://github.com/advisories/GHSA-ppx3-28rw-8fpf
- https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-pp
- https://github.com/universal-tool-calling-protocol/python-utcp/commit/fc3268e2a62e1181f91a
- https://nvd.nist.gov/vuln/detail/CVE-2026-12210
This medium severity vulnerability with a CVSS score of 4.7 was published on 2026-08-25 via GitHub. Affected: pip/utcp-gql <= 1.1.0, pip/utcp-websocket <= 1.1.0.
vulnfeed aggregates 11950 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.