Insecure Server Connection in MCP Plugin for Python-UTCP

CVE-2026-101057

What is CVE-2026-101057?

The MCP plugin for Python-UTCP prior to version 1.1.3 contains a vulnerability that allows for unvalidated connections to specified HTTP and WebSocket server URLs. This flaw arises from the lack of validation for the mcpServers configuration, which permits connections to potentially insecure, non-loopback server addresses. Consequently, the MCP handshake process is exposed to network interception, which can enable cleartext communication with internal hosts. Although the vulnerability is primarily in the configuration authored by operators, it does highlight significant security implications. The issue has been addressed in version 1.1.3 where server URLs are properly validated before any connection is established.

References