CVE-2026-129094

A UTCP tool call could reach the agent host’s loopback services

Universal Tool Calling Protocol project · TypeScript UTCP HTTP client

First documented disclosure · Review checkpoint

Summary

The HTTP client checked a remote manual’s destination before substituting a caller-selected host into the final tool URL. The tool could make a request to a service reachable locally from the agent.

Severity and exploitation evidence

Low · 2.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The HTTP client checked a remote manual’s destination before substituting a caller-selected host into the final tool URL.

Conditions required

An agent registered a remote manual, then resolved a destination selected after registration.

Potential impact

The tool could make a request to a service reachable locally from the agent.

Affected versions and configurations

@utcp/http before 1.1.14, per the CNA.

Fix and mitigation status

1.1.14.

Practical next steps

Upgrade @utcp/http to 1.1.14 or later and constrain agent network access.

Operating lesson

Validate the final destination after all tool arguments are substituted.

Evidence and limits

The earlier May advisory for a URL supplied directly by an OpenAPI document named 1.1.2. The October fix covers hosts chosen after registration. The CVE record was published on 2026-11-13.

Sources