CVE-2026-101057

Name of the Vulnerable Software and Affected Versions utcp-mcp versions prior to 1.1.3

Description The MCP plugin of python-utcp fails to apply ensure secure url validation when connecting to HTTP and WebSocket MCP server URLs defined in a call template's mcpServers configuration. This omission bypasses the HTTPS/WSS-or-loopback rule, allowing the software to establish cleartext connections to non-loopback internal hosts. Consequently, the MCP handshake is exposed to network interception. Because the mcpServers configuration is authored by the operator and the connection is limited to an MCP handshake, practical exploitation is constrained.

Recommendations Update utcp-mcp to version 1.1.3.