{"id":"CVE-2026-129094","kind":"vulnerability","aliases":["CVE-2026-129094"],"related":[],"title":"@utcp/http: SSRF lets remote manuals reach loopback services on agent machines","description":"@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine.","summary":"The @utcp/http package before 1.1.14 fails to block loopback addresses when a {host} placeholder is used, so remote tool manuals can reach local services. An attacker can use host values like 127.0.0.1 or register tools through Streamable HTTP and SSE discovery to reach internal services on the machine running the agent.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agents","ai-tooling","mcp","node","utcp"],"not_affected_if":["local-tools-only","trusted-endpoints-only"],"how_to_check":"- Check the installed version of `@utcp/http` in the project's lockfile or with `npm ls @utcp/http`\n- Look for agents that load tool manuals from remote URLs and use the `{host}` placeholder","fix":"- `@utcp/http` to `1.1.14` or later","status":"open","published_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:49:00+00:00","updated_at":"2026-11-13T16:49:00+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T16:49:00Z","model":"claude-haiku-5-5","output":{"fix":"- `@utcp/http` to `1.1.14` or later","reach":"internet","title":"@utcp/http: SSRF lets remote manuals reach loopback services on agent machines","impact":"medium","summary":"The @utcp/http package before 1.1.14 fails to block loopback addresses when a {host} placeholder is used, so remote tool manuals can reach local services. An attacker can use host values like 127.0.0.1 or register tools through Streamable HTTP and SSE discovery to reach internal services on the machine running the agent.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["utcp","mcp","agents","node"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reaches internal loopback services on the agent machine","analyst_note":"","how_to_check":"- Check the installed version of `@utcp/http` in the project's lockfile or with `npm ls @utcp/http`\n- Look for agents that load tool manuals from remote URLs and use the `{host}` placeholder","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["local-tools-only","trusted-endpoints-only"],"who_is_affected":"Teams running AI agents built on the UTCP HTTP client that load tool manuals from remote sources. Agents that only use locally defined tools or fixed, trusted endpoints are less exposed. unknown for any further detail the sources do not give.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":4616,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129094':14A,17A '-2026':13A,16A '1.1.14':29B,78C '127.0.0.1':56B,112C 'access':123C 'address':34B 'agent':10A,18B,75B,128C 'ai':20B 'ai-tool':19B 'allow':88C 'argument':110C 'attack':50B,106C 'block':32B 'bypass':96C 'check':101C 'contain':79C 'cve':12A,15A 'discoveri':65B,121C 'fail':30B 'forgeri':85C 'host':37B,53B,104C,109C 'http':62B,118C 'intern':68B,124C 'let':3A 'like':55B,111C 'local':47B 'loopback':7A,33B,93C,100C 'machin':11A,72B,129C 'manual':5A,44B,90C 'mcp':22B 'node':23B 'packag':27B 'placehold':38B,105C 'reach':6A,46B,67B,92C 'regist':58B,114C 'remot':4A,42B,89C,99C 'remote-loopback':98C 'request':84C 'run':73B 'server':82C 'server-sid':81C 'servic':8A,48B,69B,94C,125C 'side':83C 'sse':64B,120C 'ssrf':2A 'streamabl':61B,117C 'suppli':108C 'tool':21B,43B,59B,115C 'use':40B,52B 'utcp':24B 'utcp/http':1A,26B,76C 'valu':54B 'via':116C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Teams running AI agents built on the UTCP HTTP client that load tool manuals from remote sources. Agents that only use locally defined tools or fixed, trusted endpoints are less exposed. unknown for any further detail the sources do not give.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agents","aitooling","mcp","medium","node","utcp"],"campaign_type":null,"search_a":"'-129094':14A,17A '-2026':13A,16A 'agent':10A 'cve':12A,15A 'let':3A 'loopback':7A 'machin':11A 'manual':5A 'reach':6A 'remot':4A 'servic':8A 'ssrf':2A 'utcp/http':1A","search_b":"'1.1.14':29B '127.0.0.1':56B 'address':34B 'agent':18B,75B 'ai':20B 'ai-tool':19B 'attack':50B 'block':32B 'discoveri':65B 'fail':30B 'host':37B,53B 'http':62B 'intern':68B 'like':55B 'local':47B 'loopback':33B 'machin':72B 'manual':44B 'mcp':22B 'node':23B 'packag':27B 'placehold':38B 'reach':46B,67B 'regist':58B 'remot':42B 'run':73B 'servic':48B,69B 'sse':64B 'streamabl':61B 'tool':21B,43B,59B 'use':40B,52B 'utcp':24B 'utcp/http':26B 'valu':54B","search_c":"'1.1.14':78C '127.0.0.1':112C 'access':123C 'agent':128C 'allow':88C 'argument':110C 'attack':106C 'bypass':96C 'check':101C 'contain':79C 'discoveri':121C 'forgeri':85C 'host':104C,109C 'http':118C 'intern':124C 'like':111C 'loopback':93C,100C 'machin':129C 'manual':90C 'placehold':105C 'reach':92C 'regist':114C 'remot':89C,99C 'remote-loopback':98C 'request':84C 'server':82C 'server-sid':81C 'servic':94C,125C 'side':83C 'sse':120C 'streamabl':117C 'suppli':108C 'tool':115C 'utcp/http':76C 'via':116C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-05-10T11:42:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129094","severity":null,"published_at":"2026-11-13T16:18:59+00:00","modified_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null}],"documents":[{"id":147655,"url":"https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-05-10T11:42:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":147656,"url":"https://www.vulncheck.com/advisories/utcp-http-before-1.1.14-ssrf-to-loopback-via-host-placeholder-in-call-templates","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}