Server-Side Request Forgery in @utcp/http by Universal Tool Calling Protocol
CVE-2026-129094

2.3LOW

Key Information:

Vendor: Universal-tool-calling-protocol
Status: @utcp/http
Vendor: CVE Published:; 13 November 2026

🔔 Create Universal-tool-calling-protocol Vulnerability Alert

What is CVE-2026-129094?

@utcp/http versions before 1.1.14 exhibit a server-side request forgery vulnerability that allows attackers to access internal services by exploiting a loophole in the remote-loopback check. By supplying malicious host arguments, such as 127.0.0.1 or integrating certain tools through Streamable HTTP and SSE, bad actors can gain unauthorized access to services running on the local machine. This flaw underscores the importance of proper validation of host inputs in server communications.