The vulnerability in the utcp-gql and utcp-websocket modules allows attackers to craft malicious URLs that bypass the prefix validation logic, resulting in server‑side request forgery. Attackers can trigger the server to connect to arbitrary internal endpoints, including cloud metadata services, and receive sensitive configuration data such as API keys and OAuth tokens that the server forwards to the attacker’s host. The weakness is a classic Missing Input Validation flaw (CWE‑918), which can be leveraged to exfiltrate confidential information without compromising the server’s code execution directly.

The affected products are the Python-utcp libraries released by Universal Tool Calling Protocol, specifically versions earlier than 1.1.1 of both utcp-gql and utcp-websocket. Users running these components in a cloud or internal network environment and who rely on them to fetch external tool URLs are at risk.

The reported CVSS score of 2.3 reflects a low overall severity, yet the attack vector is likely an externally submitted malicious call template, which can be executed by anyone able to control those templates. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the current exploitable likelihood is uncertain, but the impact of unauthorized internal network access and credential leakage is significant.