CVE-2026-12210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12210", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-14T12:30:06.444Z", "datePublished": "2026-06-15T02:30:10.150Z", "dateUpdated": "2026-06-15T13:19:52.875Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-15T02:30:10.150Z"}, "title": "universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "universal-tool-calling-protocol", "product": "python-utcp", "versions": [{"version": "1.1.0", "status": "affected"}], "cpes": ["cpe:2.3:a:universal-tool-calling-protocol:python-utcp:*:*:*:*:*:*:*:*"], "modules": ["utcp-gql/utcp-websocket"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-14T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-14T14:35:09.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gola (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/370852", "name": "VDB-370852 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/370852/cti", "name": "VDB-370852 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-12210", "name": "CVE-2026-12210 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/832542", "name": "Submit #832542 | universal-tool-calling-protocol python-utcp 1.1.0 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/universal-tool-calling-protocol/python-utcp/issues/86", "tags": ["issue-tracking"]}, {"url": "https://github.com/gola-leya/cve_submit/issues/1", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/universal-tool-calling-protocol/python-utcp/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T13:19:45.321990Z", "id": "CVE-2026-12210", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T13:19:52.875Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12210", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T13:19:45.321990Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T13:19:50.198Z"}}], "cna": {"title": "universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "gola (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:universal-tool-calling-protocol:python-utcp:*:*:*:*:*:*:*:*"], "vendor": "universal-tool-calling-protocol", "modules": ["utcp-gql/utcp-websocket"], "product": "python-utcp", "versions": [{"status": "affected", "version": "1.1.0"}]}], "timeline": [{"lang": "en", "time": "2026-06-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-14T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-14T14:35:09.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/370852", "name": "VDB-370852 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/370852/cti", "name": "VDB-370852 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-12210", "name": "CVE-2026-12210 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/832542", "name": "Submit #832542 | universal-tool-calling-protocol python-utcp 1.1.0 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/universal-tool-calling-protocol/python-utcp/issues/86", "tags": ["issue-tracking"]}, {"url": "https://github.com/gola-leya/cve_submit/issues/1", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/universal-tool-calling-protocol/python-utcp/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-15T02:30:10.150Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12210", "state": "PUBLISHED", "dateUpdated": "2026-06-15T13:19:52.875Z", "dateReserved": "2026-06-14T12:30:06.444Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-15T02:30:10.150Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:universal-tool-calling-protocol:python-utcp:*:*:*:*:*:*:*:*"], "modules": ["utcp-gql/utcp-websocket"], "product": "python-utcp", "vendor": "universal-tool-calling-protocol", "versions": [{"status": "affected", "version": "1.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en universal-tool-calling-protocol python-utcp 1.1.0. Esto afecta una funci\u00f3n desconocida del componente utcp-gql/utcp-websocket. Realizar una manipulaci\u00f3n resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede ser iniciado remotamente. El exploit es ahora p\u00fablico y puede ser usado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-12210", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12210", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T13:19:45.321990Z", "version": "2.0.3"}}]}, "published": "2026-06-15T03:16:24.330", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/gola-leya/cve_submit/issues/1"}, {"source": "cna@vuldb.com", "url": "https://github.com/universal-tool-calling-protocol/python-utcp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/universal-tool-calling-protocol/python-utcp/issues/86"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-12210"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/832542"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/370852"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/370852/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "python-utcp", "source": "cna", "vendor": "universal-tool-calling-protocol"}, "product": "python-utcp", "vendor": "universal-tool-calling-protocol"}], "created": "2026-06-15T04:30:29.974777+00:00", "updated": "2026-06-15T05:00:20.443497+00:00", "vendors": ["universal-tool-calling-protocol", "universal-tool-calling-protocol$PRODUCT$python-utcp"]}