CVE-2026-44661 — Server-Side Request Forgery

title: CVE-2026-44661 - python-utcp SSRF via Malicious OpenAPI Spec
id: scw-2026-05-14-ai-1
status: experimental
level: critical
description: |
  Detects requests attempting to exploit CVE-2026-44661 by referencing a malicious OpenAPI specification. Attackers can host a malicious OpenAPI spec on a legitimate HTTPS endpoint, declaring internal service URLs (e.g., http://127.0.0.1:9090 or http://169.254.169.254) within the 'servers' field. This rule looks for common OpenAPI spec file names and the presence of the 'servers[0].url' parameter in the query string, indicating a potential SSRF attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44661/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/openapi.json'
          - '/swagger.json'
      cs-uri-query|contains:
          - 'servers%5B0%5D.url='
          - 'servers[0].url='
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse