CVE-2026-19373

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 5.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3
https://vuldb.com/cve/CVE-2026-19373
https://vuldb.com/submit/866271
https://vuldb.com/vuln/387257
https://vuldb.com/vuln/387257/cti
https://github.com/adenot/mcp-google-search/issues/11

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una debilidad en PhialsBasement KoboldCPP-MCP-Server 1.0.0. Afectada por este problema es la función makeRequest del archivo src/index.ts del componente BaseConfigSchema. La ejecución de una manipulación del argumento apiUrl puede conducir a falsificación de petición del lado del servidor. Es posible lanzar el ataque en el host local. El proyecto fue informado del problema tempranamente a través de un informe de problema pero aún no ha respondido.

Information

Published : 2026-08-09 23:16

Updated : 2026-10-23 20:10

NVD link : CVE-2026-19373

Mitre link : CVE-2026-19373

CVE.ORG link : CVE-2026-19373

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-19373", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19373", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T01:50:53.748748Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:*"], "vendor": "PhialsBasement", "modules": ["BaseConfigSchema"], "product": "KoboldCPP-MCP-Server", "versions": [{"status": "affected", "version": "1.0.0"}]}]}], "published": "2026-08-09T23:16:36.280", "references": [{"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/", "source": "cna@vuldb.com"}, {"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-19373", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/866271", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/387257", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/387257/cti", "source": "cna@vuldb.com"}, {"url": "https://github.com/adenot/mcp-google-search/issues/11", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en PhialsBasement KoboldCPP-MCP-Server 1.0.0. Afectada por este problema es la funci\u00f3n makeRequest del archivo src/index.ts del componente BaseConfigSchema. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento apiUrl puede conducir a falsificaci\u00f3n de petici\u00f3n del lado del servidor. Es posible lanzar el ataque en el host local. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero a\u00fan no ha respondido."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "cna@vuldb.com"}