CVE-2026-19367
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In NocteDefensor LudusMCP 1.0.24, a vulnerability was found in an unknown function of src/tools/rangeConfig.ts (read_range_config component). Manipulation of the Source argument leads to server-side request forgery (SSRF). The attack may be initiated remotely.
Risk Assessment
SSRF vulnerability may allow an attacker to access internal network resources, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to validate and sanitize the Source argument and restrict access to the read_range_config function.
Other vulnerabilities in LudusMCP
See all- CVE-2026-19366Medium
In NocteDefensor LudusMCP up to version 1.0.24, a vulnerability was found in an unknown function of src/tools/insertCredsRangeConfig.ts (insert_creds_range_config component). Manipulation of the configPath/outputPath arguments leads to path traversal. The attack is restricted to local execution.
- CVE-2026-19047Medium
A command injection vulnerability was detected in the ludus_cli_execute component of NocteDefensor LudusMCP (up to version 1.0.24). The vulnerability affects the executeArbitraryCommand/executeCommand function in src/ludusMCP/cliWrapper.ts, where manipulation of the command/args arguments leads to command injection. The attack requires local access.
Original NVD description (English source)
A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component read_range_config. The manipulation of the argument Source leads to server-side request forgery. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS