CVE-2026-82905: sdcb chats SSRF Vulnerability

CVE-2026-82905 Overview

CVE-2026-82905 is a server-side request forgery (SSRF) vulnerability in sdcb chats through version 1.12.0. The flaw resides in the McpController function within src/BE/web/Controllers/Users/Mcps/McpController.cs, part of the fetch-tools endpoint. An authenticated remote attacker can manipulate input to coerce the application into issuing HTTP requests to arbitrary destinations. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts. The weakness is classified as [CWE-918].

Critical Impact
Attackers can abuse the fetch-tools endpoint to send server-originated requests to internal services, potentially exposing metadata endpoints, internal APIs, and non-public network resources.

Affected Products

sdcb chats versions up to and including 1.12.0
Component: fetch-tools endpoint
File: src/BE/web/Controllers/Users/Mcps/McpController.cs

Discovery Timeline

2026-08-31 - CVE-2026-82905 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82905

Vulnerability Analysis

The vulnerability exists in the McpController class of sdcb chats, a component that handles Model Context Protocol (MCP) fetch-tools functionality. The controller accepts a user-supplied URL and issues an outbound HTTP request from the server without sufficient validation of the target destination. This behavior allows an attacker with authenticated access to direct the server to fetch resources from arbitrary hosts, including internal-only endpoints. A public proof-of-concept is available in the referenced GitHub Proof of Concept repository.

Root Cause

The root cause is missing validation of destination URLs supplied to the fetch-tools endpoint. The controller does not enforce an allowlist of permitted hosts, does not block requests targeting private IP ranges (RFC 1918), and does not filter loopback or link-local addresses. This maps directly to [CWE-918]: Server-Side Request Forgery.

Attack Vector

Exploitation requires network access to the sdcb chats application and low-privileged authenticated credentials. The attacker submits a crafted request to the fetch-tools endpoint referencing an internal URL such as a cloud metadata service, an internal management API, or a service bound to localhost. The server then performs the request on the attacker's behalf and returns the response content. See the VulDB CVE-2026-82905 entry for additional threat context.

No verified exploit code is included here. Review the linked proof-of-concept for reproduction details.

Detection Methods for CVE-2026-82905

Indicators of Compromise

Outbound HTTP requests from the sdcb chats application server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.1
Requests originating from the application to cloud metadata endpoints such as 169.254.169.254
Unexpected GET requests logged by the fetch-tools endpoint referencing internal hostnames

Detection Strategies

Inspect application logs for calls to McpController fetch actions with URL parameters targeting private, loopback, or link-local ranges.
Correlate authentication events with fetch-tools invocations to identify low-privileged accounts probing internal infrastructure.
Deploy egress filtering at the network layer and alert on denied outbound connections from the application host.

Monitoring Recommendations

Enable verbose logging on the fetch-tools endpoint capturing the requesting user, target URL, and response size.
Monitor DNS resolutions performed by the application process for internal or metadata hostnames.
Track anomalous spikes in outbound HTTP request volume from the application server.

How to Mitigate CVE-2026-82905

Immediate Actions Required

Restrict access to the sdcb chats application to trusted users while a fix is pending, since the vendor has not responded to disclosure.
Implement egress network controls blocking application server access to internal subnets and cloud metadata IPs.
Audit user accounts and rotate credentials for any account observed invoking the fetch-tools endpoint against internal targets.

Patch Information

No vendor patch is available. The maintainers of sdcb chats did not respond to disclosure per the VulDB submission. Organizations running versions up to 1.12.0 should apply compensating controls and track the project repository for future releases.

Workarounds

Place the application behind a proxy that enforces an allowlist of permitted external destinations for fetch operations.
Block outbound traffic from the application host to 169.254.169.254 and all RFC 1918 ranges not required for operation.
Disable or remove the fetch-tools functionality if it is not required for your deployment.
Require additional authentication or role checks on any route exposing McpController actions.

bash

# Example egress restriction using iptables to block metadata and internal ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT