{"action":"Upgrade utcp-gql to 1.1.1 or later.","affected":[{"fixed":"1.1.1","introduced":"0"}],"component":"utcp-gql","cve_ids":["CVE-2026-12210"],"ecosystem":"PyPI","epss":0.00228,"exploited":false,"fixed_versions":["1.1.1"],"ghsa_id":"GHSA-ppx3-28rw-8fpf","id":"tcs_01M5KH8P1JYJSGE9X21811XR9M","modified_at":"2026-09-10T12:25:27.895560902Z","published_at":"2026-09-10T09:44:55.718603Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3931","https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-ppx3-28rw-8fpf","https://nvd.nist.gov/vuln/detail/CVE-2026-12210","https://github.com/gola-leya/cve_submit/issues/1","https://github.com/universal-tool-calling-protocol/python-utcp/issues/86","https://github.com/universal-tool-calling-protocol/python-utcp/commit/fc3268e2a62e1181f91a63faf0a9bcee7639db29","https://github.com/universal-tool-calling-protocol/python-utcp","https://vuldb.com/cve/CVE-2026-12210","https://vuldb.com/submit/832542","https://vuldb.com/vuln/370852","https://pypi.org/project/utcp-gql","https://github.com/advisories/GHSA-ppx3-28rw-8fpf"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3931","url":"https://osv.dev/vulnerability/PYSEC-2026-3931"}],"summary":"utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins"}