CVE-2026-45370: CVE-2026-45370: Environment Variable Leak in python-utcp CLI Subprocesses

#security #cve #cybersecurity

CVE-2026-45370: Environment Variable Leak in python-utcp CLI Subprocesses

Vulnerability ID: CVE-2026-45370
CVSS Score: 7.7
Published: 2026-05-14

The python-utcp library improperly exposes the host application's full environment variables to spawned subprocesses via os.environ.copy(). When combined with an existing command injection flaw, attackers can exfiltrate all host secrets in a single request.

TL;DR

python-utcp prior to version 1.1.3 improperly exposes process-level environment variables to CLI subprocesses, enabling secret exfiltration when chained with command injection vulnerabilities.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-526
CVSS Score: 7.7 (High)
Attack Vector: Network
Impact: High Confidentiality Loss
Affected Component: cli_communication_protocol.py
Related CVE: CVE-2026-45369

Affected Systems

python-utcp
Universal Tool Calling Protocol (UTCP) CLI applications
python-utcp: < 1.1.3 (Fixed in: 1.1.3)

Mitigation Strategies

Upgrade the python-utcp library to version 1.1.3 or higher.
Override the _prepare_environment() function to return an explicit allowlist of environment variables.
Implement defense-in-depth by adopting short-lived, scoped credentials instead of permanent environment variables.
Monitor subprocess creation logs for suspicious shell commands or arguments.

Remediation Steps:

Identify all deployments utilizing the python-utcp package.
Update requirements.txt or pipfile to mandate python-utcp >= 1.1.3.
Restart the application to ensure the patched library is loaded into memory.
If compromise is suspected, immediately rotate all secrets, API keys, and database credentials previously stored in the host environment.

References

Read the full report for CVE-2026-45370 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community