CVE-2026-82905

Name of the Vulnerable Software and Affected Versions sdcb chats versions prior to 1.12.0

Description A remote server-side request forgery (SSRF) issue exists within the fetch-tools Endpoint component. The flaw is located in the McpController() function of the src/BE/web/Controllers/Users/Mcps/McpController.cs file. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations As a temporary workaround, restrict access to the McpController() function within the fetch-tools Endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.