CVE-2026-19373: PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19373?
The severity of CVE-2026-19373 is medium with a score of 5.3.
What is the impact of CVE-2026-19373?
CVE-2026-19373 can lead to server-side request forgery (SSRF) through the manipulation of the apiUrl argument.
How do I fix CVE-2026-19373?
To fix CVE-2026-19373, you should validate and sanitize user inputs for the apiUrl argument in the makeRequest function.
Which software is affected by CVE-2026-19373?
CVE-2026-19373 affects PhialsBasement KoboldCPP-MCP-Server version 1.0.0.
When was CVE-2026-19373 published?
CVE-2026-19373 was published on August 9, 2026.