CVE-2026-45370: Environment Variable Leak in python-utcp CLI Subprocesses

Vulnerability ID: CVE-2026-45370

CVSS Score: 7.7

Published: 2026-05-14

The python-utcp library improperly exposes the host application's full environment variables to spawned subprocesses via os.environ.copy(). When combined with an existing command injection flaw, attackers can exfiltrate all host secrets in a single request.

TL;DR

python-utcp prior to version 1.1.3 improperly exposes process-level environment variables to CLI subprocesses, enabling secret exfiltration when chained with command injection vulnerabilities.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-526

CVSS Score : 7.7 (High)

Attack Vector : Network

Impact : High Confidentiality Loss

Affected Component : cli_communication_protocol.py

Related CVE : CVE-2026-45369

Affected Systems

python-utcp

Universal Tool Calling Protocol (UTCP) CLI applications

python-utcp : < 1.1.3 (Fixed in: 1.1.3 )

Mitigation Strategies

Upgrade the python-utcp library…