CVE-2026-19373

Name of the Vulnerable Software and Affected Versions PhialsBasement KoboldCPP-MCP-Server version 1.0.0

Description A server-side request forgery (SSRF) issue exists within the BaseConfigSchema component in the src/index.ts file. The flaw occurs in the makeRequest() function, where manipulation of the apiUrl variable allows an attacker to induce the server to make unauthorized requests, including attacks targeting the local host.

Recommendations As a temporary mitigation, restrict or validate the input provided to the apiUrl variable used in the makeRequest() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.