THREAT OPS › Threat News › [GHSA] GHSA-ppx3-28rw-8fpf (medium) — utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
[GHSA] GHSA-ppx3-28rw-8fpf (medium) — utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
GHSA-ppx3-28rw-8fpf Severity: medium CVE: None
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
### Summary
The fix for CVE-2026-44661 (commit `5b16e43`) added the `ensure_secure_url()` / `is_secure_url()` helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin (`utcp-gql`) still uses
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-44661cve
- http://127.0.0.1.attacker.example`url
- http://localhost.evil.com`url
- http://127.0.0.1url
- http://127.0.0.1.attacker.example/graphqlurl
- http://localhost.evil.com/graphql`url
Original source: https://github.com/advisories/GHSA-ppx3-28rw-8fpf