utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
- Product
- utcp-http
- Affected
- utcp-http <= 1.1.3
- Fixed in
- 1.1.4
Last verified against sources: October 26, 2026
Am I affected?
utcp-http: affected utcp-http <= 1.1.3. Fixed in 1.1.4.
- Check your version: run
pip show utcp-http. Versions <= 1.1.3 of utcp-http are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "utcp-http>=1.1.4"(first patched version 1.1.4). [1] - Upgrade to
utcp-http >= 1.1.4. [1] - No workaround in earlier versions short of disabling all attacker-influenced manuals. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
HttpCommunicationProtocol.call_toolvalidates only the pre-redirect tool URL, then issues the request with redirects enabled and never re-checks where it lands. [1]- A tool whose endpoint is an attacker-controlled public URL can therefore
302-redirect the UTCP client into an internal service including the cloud metadata endpoint and the response body is returned to the tool caller. [1] - This vector bypasses the GHSA-39j6-4867-gg4w mitigation via unvalidated redirects. [1]
Impact
- Blind-to-readable SSRF from the UTCP host's network position, with the internal response handed back to the caller. [1]
- On a cloud instance with IMDSv1 this yields the instance role's IAM credentials, i.e. infrastructure takeover. [1]
- More generally it reaches internal HTTP services (admin panels, unauth datastores, link-local endpoints) that the validator is specifically meant to block. [1]
What was done
- Fixed in
utcp-http1.1.4. [1] _security.pynow shipssafe_request_with_redirects, a per-hop revalidator that disables aiohttp's auto-follow, runsensure_secure_urlon everyLocationheader before issuing the next hop, caps the chain at 5 hops, and drops the body on 303 per RFC 7231. [1]- The sister TypeScript implementation
@utcp/httpis fixed the same way in 1.1.4. [1]
Sources
- GHSA-9qhg-99ww-9mqc — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
Product: utcp-http | Affected: utcp-http <= 1.1.3 | Fixed in: 1.1.4
Summary: `HttpCommunicationProtocol.call_tool` validates only the pre-redirect tool URL, then issues the request with redirects enabled and never re-checks where it lands.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/08/ghsa-9qhg-99ww-9mqc-utcp-httpCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for utcp-http
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.