CVE-2026-101059 in python-utcp
Summary
by MITRE • 09/27/2026
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability in utcp-http versions prior to 1.1.4 represents a critical flaw in how the library handles authentication flows for APIs defined by remote OpenAPI specifications. Specifically, the component fails to perform adequate validation on the OAuth2 tokenUrl field extracted from these external definitions. This lack of input validation allows an attacker who controls or influences the content of an OpenAPI specification file to inject malicious URLs into the token endpoint configuration. When a victim application utilizes this library to interact with such a compromised API, it blindly trusts the provided URL structure without verifying its legitimacy against expected domains or protocols.
From a technical perspective, the core issue lies in the absence of strict allowlisting or pattern matching for the OAuth2 authorization server endpoints. During the standard OAuth 2.0 client credentials flow, which is commonly used by machine-to-machine communication, the library automatically constructs and sends an HTTP POST request to the tokenUrl specified in the OpenAPI document. This request contains sensitive authentication material, specifically the client_id and client_secret of the victim application. Because utcp-http does not validate whether this URL points to a trusted or expected identity provider, it facilitates a classic server-side request forgery scenario where the credentials are exfiltrated directly to an attacker-controlled endpoint rather than being exchanged for valid access tokens with the legitimate service.
The operational impact of this vulnerability is severe, primarily due to the exposure of long-lived client secrets that often grant broad permissions within cloud environments or enterprise systems. If an attacker successfully captures these credentials through a malicious OpenAPI specification hosted on their own server, they can use them to impersonate the victim application. This leads to unauthorized access to protected resources, potential data exfiltration, and further lateral movement within the target infrastructure. The risk is amplified in microservices architectures where services frequently discover each other via dynamic API definitions, making it easier for an attacker to inject a malicious specification into the discovery mechanism or documentation repository that these services consume.
This flaw aligns with CWE-20 Improper Input Validation and CWE-918 Server-Side Request Forgery (SSRF). The failure to restrict the destination of internal requests based on predefined trust boundaries is characteristic of SSRF vulnerabilities, while the specific mishandling of configuration data from external sources falls under improper input validation. In terms of adversary tactics, this vulnerability supports techniques associated with MITRE ATT&CK T1504 Web Service Discovery and potentially T1078 Valid Accounts if the stolen credentials are used to maintain persistent access. Attackers can leverage this mechanism to harvest secrets without triggering typical network-based intrusion detection systems that might not inspect outbound traffic from internal services as closely as inbound traffic.
To mitigate this risk, organizations must immediately upgrade utcp-http to version 1.1.4 or later where the validation logic has been corrected. For environments unable to update promptly, a defensive coding approach should be implemented by wrapping the library calls with custom middleware that validates the tokenUrl against an allowlist of known and trusted identity providers before any authentication request is made. Additionally, developers should audit their OpenAPI specification sources for integrity and ensure that only approved specifications are consumed in production environments. Implementing strict CORS policies on internal services and monitoring outbound HTTP traffic from application servers can also help detect attempts to exfiltrate credentials via this vector.