MCPA-2026-0093
lowssrfCVSS 5.3
KoboldCPP-MCP-Server makeRequest server-side request forgery (CVE-2026-19373)
KoboldCPP-MCP-Server (npm: server-koboldai) 1.0.0 is vulnerable to SSRF: src/index.ts (component BaseConfigSchema / makeRequest) accepts an apiUrl argument on every tool call and passes it straight into fetch() request URLs (`${apiUrl}/v1/chat/completions`, `${apiUrl}${endpoint}`) with no allowlist or network-range validation, so a poisoned tool call can point the server at loopback, private-network, or cloud-metadata URLs from its network position and read the responses (verified by unpacking the published server-koboldai@1.0.0 tarball). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-10, so this is recorded as last_affected 1.0.0.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | server-koboldai | >= 0, <= 1.0.0 |
Identifiers
CVE-2026-19373GHSA-m2hf-r4mh-rrq8CWE-918
References
- advisory https://github.com/advisories/GHSA-m2hf-r4mh-rrq8
- web https://nvd.nist.gov/vuln/detail/CVE-2026-19373
- web https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3
- web https://github.com/PhialsBasement/KoboldCPP-MCP-Server
Timeline
- Published: 2026-08-10