CVE-2026-82905: Server-Side Request Forgery in sdcb chats

This vulnerability in sdcb chats up to version 1.12.0 involves the McpController function in src/BE/web/Controllers/Users/Mcps/McpController.cs of the fetch-tools endpoint. It allows an attacker to perform server-side request forgery (SSRF) remotely by manipulating requests processed by the server. The vulnerability was disclosed publicly with exploit code available, but the vendor has not issued any advisory or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this SSRF vulnerability to cause the server to make unintended requests, potentially accessing internal resources or services not otherwise reachable. The impact is rated medium, reflecting limited confidentiality, integrity, and availability consequences. No evidence of active exploitation in the wild is reported.

No official fix or patch is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a patch is released, consider implementing network-level controls to restrict outbound requests from the affected component and apply any available application-layer mitigations to validate and sanitize input to the McpController function.