Is CVE-2026-105797 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105797 being exploited in the wild.

How severe is CVE-2026-105797?

High severity, with a CVSS score of 8.8, published 6 October 2026.

Which products and versions are affected?

Microsoft SimpleChat 0.261.003, 0.261.027.

Is there a fix for CVE-2026-105797?

Yes: fixed in 0.261.031. Until then: Move the type auto-fill logic from metadata before the _reject_non_admin_mcp_stdio gate, and add a scope assertion in McpPluginFactory.create_connector to restrict stdio transport to global admin actions only. [{"kind":"disclosed","at":"2026-09-19","note":"GitHub security advisory published"},{"kind":"patched","at":"2026-09-19","note":"Fix released in version 0.261.031"},{"kind":"advisory","at":"2026-10-06","note":"CVE-2026-105797 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105797 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105797?

Check whether you run Microsoft SimpleChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105797: SimpleChat authorization ordering flaw in MCP plugins

CVE-2026-105797 · Severity: high · CVSS 8.8 · Published 2026-10-06

SimpleChat is a secure AI conversation application that allows users to configure plugins for document analysis and interactions. An authentication bypass flaw in versions 0.261.003 through 0.261.027 allows authenticated low-privileged users to register and execute arbitrary operating system processes under the web server's identity by registering Model Context Protocol (MCP) actions with the stdio transport. An attacker can exploit this to access environment variables, tokens, and secrets stored on the application server, or to disrupt service availability.

Technologies: Microsoft SimpleChat. Vendors: Microsoft.

Quick answers

Is CVE-2026-105797 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105797 being exploited in the wild.
How severe is CVE-2026-105797?: High severity, with a CVSS score of 8.8, published 6 October 2026.
Which products and versions are affected?: Microsoft SimpleChat 0.261.003, 0.261.027.
Is there a fix for CVE-2026-105797?: Yes: fixed in 0.261.031. Until then: Move the type auto-fill logic from metadata before the _reject_non_admin_mcp_stdio gate, and add a scope assertion in McpPluginFactory.create_connector to restrict stdio transport to global admin actions only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-19","note":"GitHub security advisory published"},{"kind":"patched","at":"2026-09-19","note":"Fix released in version 0.261.031"},{"kind":"advisory","at":"2026-10-06","note":"CVE-2026-105797 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105797 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105797?: Check whether you run Microsoft SimpleChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.261.031

Move the type auto-fill logic from metadata before the _reject_non_admin_mcp_stdio gate, and add a scope assertion in McpPluginFactory.create_connector to restrict stdio transport to global admin actions only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-19","note":"GitHub security advisory published"},{"kind":"patched","at":"2026-09-19","note":"Fix released in version 0.261.031"},{"kind":"advisory","at":"2026-10-06","note":"CVE-2026-105797 published"}]

Technical details

The vulnerability exists in POST /api/user/plugins where the _reject_non_admin_mcp_stdio authorization gate checks the top-level type field and exits early if it is missing, allowing an attacker to supply type via metadata.type instead. After the gate passes, lines 1030–1035 restore type from metadata, bypassing the stdio transport restriction. At runtime, MCPStdioPlugin.connect() is called without verifying the action scope is global, spawning the attacker-supplied command under the application service identity. Requires authenticated access, personal plugins enabled, and governance permitting MCP actions.

Affected products

Microsoft SimpleChat 0.261.003, 0.261.027

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.