CVE-2026-19373

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0

1.9CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-25)

CWE

CWE-918

Published

2026-08-09

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://github.com/PhialsBasement/KoboldCPP-MCP-Server/
• https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3
• https://vuldb.com/cve/CVE-2026-19373
• https://vuldb.com/submit/866271
• https://vuldb.com/vuln/387257

Check your stackJSON