The vulnerability originates from the utcp-http plugin of python-utcp where input validation performed during manual discovery is not repeated when a tool is invoked. A malicious OpenAPI specification can be hosted on a legitimate HTTPS domain and contain a servers[0].url pointing to internal addresses such as 127.0.0.1 or the metadata service. When the client processes this spec, it blindly trusts the declared server URL and sends HTTP requests to the specified internal service, revealing the internal network or sensitive data. This is a blind SSRF, giving the attacker indirect control over the host's outbound connections without requiring authentication.

Affected software is the python-utcp implementation of UTCP. Versions prior to 1.1.3 are vulnerable. The bug exists in all three HTTP‑class protocols that the plugin supports: utcp_http.http, utcp_http.streamable_http, and utcp_http.sse.

The CVSS score of 4.7 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker hosting a malicious OpenAPI specification on a trusted HTTPS server that the victim’s python-utcp client accesses. Because no authentication or additional credentials are required, the vulnerability can be leveraged by anyone who can influence the URL that the client processes. The exploit probability is uncertain due to missing EPSS data but the presence of the flaw in a widely used protocol library suggests potential for exploitation in environments where OpenAPI specs are fetched from external sources.