CVE-2026-19373

PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery

State: Published
Severity: 4.8 Medium
Published: Aug 9, 2026
Updated: Aug 11, 2026
Reserved: Aug 9, 2026

Description

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
KoboldCPP-MCP-ServerPhialsBasement	1.0.0Affected

References

VDB-387257 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgeryvdb-entrytechnical-description
VDB-387257 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-19373 | CVE Analysis and Reportthird-party-advisory
Submit #866271 | PhialsBasement KoboldCPP-MCP-Server 1.0.0 Server-Side Request Forgerythird-party-advisory
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3issue-tracking
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/product
https://github.com/adenot/mcp-google-search/issues/11exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.