Koboldcpp Mcp Server
Monthly
Server-side request forgery in KoboldCPP-MCP-Server 1.0.0 allows a local, low-privileged attacker to manipulate the `apiUrl` argument within the `makeRequest` function of the BaseConfigSchema component, coercing the server into issuing arbitrary HTTP requests on behalf of the attacker. The attack surface is confined to local access only, limiting the immediate blast radius, but SSRF in an MCP (Model Context Protocol) server could be leveraged to reach internal network resources or localhost services otherwise inaccessible to the attacker. No vendor patch exists and the project has not responded to the responsible disclosure; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric.
Server-side request forgery in KoboldCPP-MCP-Server 1.0.0 allows a local, low-privileged attacker to manipulate the `apiUrl` argument within the `makeRequest` function of the BaseConfigSchema component, coercing the server into issuing arbitrary HTTP requests on behalf of the attacker. The attack surface is confined to local access only, limiting the immediate blast radius, but SSRF in an MCP (Model Context Protocol) server could be leveraged to reach internal network resources or localhost services otherwise inaccessible to the attacker. No vendor patch exists and the project has not responded to the responsible disclosure; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric.