CVE-2026-19373 identifies a server-side request forgery vulnerability in PhialsBasement KoboldCPP-MCP-Server 1.0.0. The vulnerability exists in the makeRequest function within src/index.ts of the BaseConfigSchema component. By manipulating the apiUrl argument, an attacker with at least low privileges can induce the server to make unauthorized requests, including to the local host. The project was notified early but has not issued a patch or mitigation guidance. No known exploits are reported in the wild.

An attacker with low privileges can exploit this SSRF vulnerability to make the server perform unauthorized requests, including to internal resources on the local host. This may lead to information disclosure or interaction with internal services not otherwise accessible. The CVSS score of 4.8 reflects a medium severity impact with limited attack vector (local) and privileges required.

No official fix or patch has been released by the vendor as of the publication date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable function and monitor for suspicious activity related to apiUrl manipulation. Avoid exposing the affected service to untrusted users.