CVE-2026-19373 Overview
CVE-2026-19373 is a Server-Side Request Forgery (SSRF) vulnerability in PhialsBasement KoboldCPP-MCP-Server version 1.0.0. The flaw resides in the makeRequest function within src/index.ts, part of the BaseConfigSchema component. An attacker with local access can manipulate the apiUrl argument to coerce the server into issuing arbitrary outbound HTTP requests. The project maintainer was notified through a public issue report but has not yet responded. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated local attacker can abuse the unvalidated apiUrl parameter in makeRequest to trigger outbound requests from the server, enabling probing of internal services accessible to the KoboldCPP-MCP-Server process.
Affected Products
- PhialsBasement KoboldCPP-MCP-Server 1.0.0
- Component: BaseConfigSchema in src/index.ts
- Function: makeRequest
Discovery Timeline
- 2026-08-09 - CVE-2026-19373 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19373
Vulnerability Analysis
The vulnerability exists in the makeRequest function of src/index.ts, which processes a caller-supplied apiUrl argument without adequate validation or allow-list enforcement. Because the destination URL is user-controllable, the server can be instructed to issue HTTP requests to arbitrary hosts and ports reachable from the server process. This matches the classic Server-Side Request Forgery pattern described in CWE-918.
The KoboldCPP-MCP-Server component acts as a Model Context Protocol (MCP) bridge to KoboldCPP. When an MCP client invokes an operation that flows through makeRequest, the server performs the outbound HTTP call on behalf of the caller. This means the request originates from the trust boundary of the server host rather than the client, which is precisely what makes SSRF useful to an attacker.
Exploitation requires local access and low-privilege authentication, and the resulting impact on confidentiality, integrity, and availability is limited. No public proof-of-concept exploit has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is missing validation of the apiUrl input inside makeRequest. The function forwards the argument directly into an HTTP client without verifying the scheme, host, or destination against an allow-list. There is no filtering of loopback addresses, private RFC1918 ranges, link-local addresses, or cloud metadata endpoints.
Attack Vector
An attacker with local access to the MCP interface supplies a crafted apiUrl value pointing to an internal target, for example a loopback service on the host or a metadata endpoint on a cloud instance. The server dereferences the URL and returns the response content or side effects to the caller. This can be used to enumerate internal services, retrieve tokens from metadata services, or interact with services that trust local traffic.
Because no verified proof-of-concept has been published, technical details are described in prose. See the GitHub Issue Discussion and the VulDB Vulnerability Report for additional context.
Detection Methods for CVE-2026-19373
Indicators of Compromise
- Outbound HTTP connections from the KoboldCPP-MCP-Server process to loopback interfaces, RFC1918 ranges, or cloud metadata endpoints such as 169.254.169.254.
- MCP request logs containing apiUrl values that reference internal hostnames, IP literals, or non-standard schemes.
- Unexpected DNS resolutions initiated by the server process for internal-only hostnames.
Detection Strategies
- Instrument the makeRequest code path to log the resolved destination host, port, and scheme for every outbound call, then alert on any non-allow-listed destination.
- Correlate MCP client input containing apiUrl with subsequent egress traffic from the server host to identify user-controlled destinations.
- Baseline the normal set of remote endpoints the server contacts and flag deviations, particularly to private address space.
Monitoring Recommendations
- Monitor process-level network telemetry for the Node.js runtime executing KoboldCPP-MCP-Server and record destination IPs and ports.
- Capture and retain MCP protocol request bodies where feasible so that the apiUrl argument is auditable after the fact.
- Alert on any connection attempt from the server to cloud instance metadata services or internal management interfaces.
How to Mitigate CVE-2026-19373
Immediate Actions Required
- Restrict local access to the KoboldCPP-MCP-Server so that only trusted users and processes can send MCP requests.
- Do not run the server on hosts that expose sensitive internal services or cloud metadata endpoints on the same network namespace.
- Track the upstream GitHub Project Repository and the open GitHub Issue Discussion for a maintainer response.
Patch Information
No official patch is available at the time of publication. According to the CVE description, the project was informed through an issue report but has not responded. Users should monitor the GitHub Project Repository for updates and consider maintaining a local fork with input validation applied to makeRequest until an upstream fix ships.
Workarounds
- Apply a local patch to makeRequest in src/index.ts that validates the scheme (allow only http/https), rejects IP literals, and enforces an allow-list of destination hostnames.
- Run the KoboldCPP-MCP-Server inside a restricted network namespace or container with egress firewall rules that block traffic to loopback, RFC1918, and metadata addresses.
- Deploy a forward proxy in front of the server and only permit outbound HTTP to explicitly approved KoboldCPP backends.
# Example egress restriction using iptables to block SSRF-relevant targets
iptables -A OUTPUT -m owner --uid-owner koboldmcp -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner koboldmcp -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner koboldmcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner koboldmcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner koboldmcp -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
