Environment Exposure Vulnerability in Python-UTCP by Universal Tool Calling Protocol
CVE-2026-45370

7.7HIGH

Key Information:

Vendor

Universal-tool-calling-protocol

Status
Python-utcp
Vendor
CVE Published:
14 May 2026

What is CVE-2026-45370?

The python-utcp library, utilized for UTCP implementations, exposes environment variables to potentially malicious CLI subprocesses. Specifically, prior to version 1.1.3, the _prepare_environment() function inadvertently passes a full copy of os.environ, which could enable an attacker, when combined with the related CVE, to effectively exfiltrate sensitive process-level secrets within a single tool invocation. Users are strongly advised to upgrade to version 1.1.3 to mitigate this vulnerability.

Affected Version(s)

python-utcp < 1.1.2

References

https://github.com/universal-tool-calling-protocol/python...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.