This vulnerability affects PhialsBasement KoboldCPP-MCP-Server 1.0.0 in the makeRequest function of src/index.ts (BaseConfigSchema component). By manipulating the apiUrl argument, an attacker can cause the server to perform unintended requests, constituting a server-side request forgery (SSRF). The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction (UI:N). The vendor has not provided a remediation or patch at this time.

An attacker with local access and low privileges can exploit this vulnerability to make the server send unauthorized requests to internal or external systems. This could potentially lead to information disclosure or interaction with internal services not intended to be accessible. However, the impact is limited by the local attack vector and the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to the makeRequest function. Avoid exposing the vulnerable version 1.0.0 in untrusted environments until a fix is available.