CVE-2026-19373
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In PhialsBasement KoboldCPP-MCP-Server 1.0.0, a weakness was found in the makeRequest function of src/index.ts (BaseConfigSchema component). Manipulation of the apiUrl argument leads to server-side request forgery (SSRF). The attack can be launched locally.
Risk Assessment
SSRF vulnerability may allow an attacker to access internal resources, potentially leading to system security compromise.
Recommendation
It is recommended to validate and sanitize the apiUrl argument and restrict access to the makeRequest function to trusted users only.
Original NVD description (English source)
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.