EUVD-2026-54960
GHSA-m2hf-r4mh-rrq8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector (description confirms 'local host'), low privileges needed to supply apiUrl, no scope change, and limited Low-tier CIA impacts.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in KoboldCPP-MCP-Server 1.0.0 allows a local, low-privileged attacker to manipulate the apiUrl argument within the makeRequest function of the BaseConfigSchema component, coercing the server into issuing arbitrary HTTP requests on behalf of the attacker. The attack surface is confined to local access only, limiting the immediate blast radius, but SSRF in an MCP (Model Context Protocol) server could be leveraged to reach internal network resources or localhost services otherwise inaccessible to the attacker. No vendor patch exists and the project has not responded to the responsible disclosure; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric.
Technical ContextAI
KoboldCPP-MCP-Server (CPE: cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:*) is a Model Context Protocol server adapter for KoboldCPP, a local AI inference backend popular in self-hosted LLM communities. The vulnerability is classified under CWE-918 (Server-Side Request Forgery), meaning the application accepts a user-controlled URL (apiUrl) in its BaseConfigSchema and passes it to an outbound HTTP request in src/index.ts:makeRequest() without adequate validation or allowlisting of the destination. Because the MCP server acts as an intermediary between a client (e.g., an AI assistant frontend) and the KoboldCPP backend, an attacker who can supply configuration parameters can redirect outbound calls to internal endpoints, loopback addresses, or cloud metadata services reachable from the host.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project has not responded to the disclosure reported at https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3. As a primary compensating control, restrict who can supply or modify the apiUrl configuration parameter in BaseConfigSchema by ensuring only fully trusted administrators can write to the MCP server's configuration; this limits the pool of potential abusers. Additionally, deploy network egress filtering on the host to block outbound HTTP/S requests to internal RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, fd00:ec2::254), which are the primary SSRF pivot targets; note this may interfere with legitimate LAN connectivity in some setups. If running on a cloud VM, consider disabling or restricting access to the instance metadata service. Consumers should monitor the upstream GitHub repository at https://github.com/PhialsBasement/KoboldCPP-MCP-Server/ for a patched release.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today