Medium severity6.3NVD Advisory· Published Mar 9, 2026· Updated Apr 29, 2026
CVE-2026-3788
CVE-2026-3788
Description
A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of the argument apiUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.4.5.4 will fix this issue. The name of the patch is 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7nvdPatch
- github.com/Bytedesk/bytedesk/issues/20nvdExploitThird Party Advisory
- github.com/Bytedesk/bytedesk/issues/20nvdExploitThird Party Advisory
- github.com/Bytedesk/bytedesk/issues/20nvdExploitThird Party Advisory
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4nvdRelease Notes
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.