Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

utcp-websocket

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.7PyPIPublished

    utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

    CVE-2026-12210 · GHSA-ppx3-28rw-8fpf

    Affected
    • PyPI utcp-websocket <= 1.1.0
    Fixed in
    1.1.1· Vendor fix available
    Issue
    The fix for CVE-2026-44661 (commit 5b16e43) added the ensuresecureurl() / issecureurl() helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin (utcp-gql) still uses the startswith prefix check that the fix explicitly replaced, so http://127.0.0.1.attacker.example and http://localhost.evil.com pass it. The WebSocket plugin (utcp-websocket) performs no URL validation at all, even though its own docstrings state it enforces "WSS or localhost only." Both plugins reach the same SSRF that CVE-2026-44661 was filed for, and because both attach the call template's configured auth headers to the outbound connection, the SSRF can also leak API keys and OAuth tokens to an attacker-controlled host. Details In the CVE-2026-44661 fix (commit 5b16e43 ("fix(http): block SSRF via attacker-controlled OpenAPI servers[0].url")), two things in it pointed at sibling issues. The commit message says the change is "replacing…

    Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →