Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19373PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery

Medium 5.3

In plain English

A medium-severity server-side request forgery in KoboldCPP-MCP-Server from PhialsBasement. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 94.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
PhialsBasement	KoboldCPP-MCP-Server	1.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-387257 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery vdb-entry, technical-description
VDB-387257 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-19373 | CVE Analysis and Report third-party-advisory
Submit #866271 | PhialsBasement KoboldCPP-MCP-Server 1.0.0 Server-Side Request Forgery third-party-advisory
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3 issue-tracking
https://github.com/PhialsBasement/KoboldCPP-MCP-Server/ product
https://github.com/adenot/mcp-google-search/issues/11 exploit