SSRF in sdcb chats MCP fetch-tools Endpoint
First seen Sep 1, 2026 · Updated Sep 1, 2026 · CVSS 6.3
The sdcb 'chats' application (up to v1.12.0) contains a server-side request forgery (SSRF) vulnerability in its MCP-related fetch-tools endpoint, allowing a remote attacker to make the server issue arbitrary HTTP requests. A public exploit exists and the vendor has not responded to disclosure, so this remains unpatched. Severity is moderate given the network-based attack vector but no confirmed data exfiltration or code execution in the description.
Technical Analysis
The vulnerability resides in McpController's fetch-tools endpoint, which likely accepts a user-supplied URL (e.g., for fetching MCP tool metadata or remote resources) without adequate validation or allow-listing. An attacker can supply an internal or attacker-controlled URL, causing the server to make requests on the attacker's behalf, potentially reaching internal network services, cloud metadata endpoints, or bypassing firewall restrictions. Because this component is tied to MCP tool-fetching functionality, the SSRF could be leveraged to probe or pivot into internal infrastructure that hosts other MCP servers or agent backends, effectively using the agent framework's trust boundary as a network proxy. No authentication is explicitly noted as required, and the exploit is publicly available, increasing near-term risk despite the moderate CVSS score.
Affected Systems
sdcb chats; protocols: MCP
Detection Signatures
- Outbound HTTP requests from the chats server to unexpected internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254)
- Requests to McpController fetch-tools endpoint containing internal hostnames, IP literals, or non-standard schemes (file://, gopher://, dict://)
- Anomalous spikes in outbound connection attempts correlated with McpController logs
- User-supplied URL parameters in fetch-tools requests lacking validation against an allow-list
Remediation Steps
- 1
Upgrade or patch
Monitor sdcb/chats repository for a fix beyond 1.12.0; since the vendor is unresponsive, consider forking and patching the fetch-tools endpoint internally.
- 2
Implement URL allow-listing
Restrict the fetch-tools endpoint to a strict allow-list of permitted domains/IPs and disallow requests to private/internal address ranges and cloud metadata endpoints.
- 3
Network segmentation
Deploy the chats/MCP server in a network segment with egress filtering to prevent SSRF from reaching sensitive internal services.
- 4
Disable or restrict fetch-tools feature
If not essential, disable the fetch-tools endpoint or gate it behind authentication and rate limiting until a fix is available.
- 5
Monitor and alert
Add logging and alerting for outbound requests initiated by McpController to detect exploitation attempts.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.