CVE-2026-82905

MediumCVSS 6.3

Published: 31/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

A vulnerability was detected in sdcb chats up to version 1.12.0. It affects the McpController function in the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the fetch-tools Endpoint component. The manipulation results in server-side request forgery. The attack can be launched remotely, and the exploit is public.

Risk Assessment

The risk is the possibility of remote exploitation to perform unauthorized server-side requests, potentially leading to disclosure of internal resources or privilege escalation.

Recommendation

It is recommended to immediately update sdcb chats to the latest available version that fixes this vulnerability. Also monitor logs for suspicious requests to the fetch-tools endpoint.

Other vulnerabilities in sdcb chats

CVE-2026-82906Low
A flaw has been found in sdcb chats up to version 1.12.0. It affects the DownloadPublic function in FileController.cs (Signed File Download Endpoint). Missing authentication allows remote exploitation, but the attack complexity is high and exploitability is difficult. The exploit has been published.

Original NVD description (English source)

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS