CVE-2026-101060: Server-Side Request Forgery in python-utcp
A critical vulnerability (CVE-2026-101060) with a CVSS score of 8.2 was discovered in python-utcp versions before 1.1.4. This vulnerability allows attackers to exploit a server-side request forgery (SSRF) weakness in the HttpCommunicationProtocol.call_tool function, potentially leading to unauthorized access to internal services and cloud metadata endpoints. The vulnerability is not actively exploited but poses a significant risk due to its high severity and potential impact. Immediate patching to version 1.1.4 or later is strongly recommended.