Description

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T23:16:36.280Z",
  "pubdate": "2026-08-09T23:16:36.280Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability has been identified in PhialsBasement KoboldCPP-MCP-Server version 1.0.0. The security flaw resides within the makeRequest function located in the src/index.ts file under the BaseConfigSchema component. This vulnerability arises due to insufficient input validation and sanitization of the apiUrl argument, which allows unauthenticated or locally privileged malicious actors to induce the server into initiating arbitrary HTTP requests to internal or external destinations. Exploitation of this flaw can result in severe security implications, including unauthorized access to internal network resources, exposure of sensitive metadata services, and potential pivoting within the local network infrastructure. The attack can be executed against the local host. The vendor has been formally notified via an early issue report but has not yet provided an official response or patched implementation.",
  "technicalDetails": "The vulnerability is classified as Server-Side Request Forgery and stems from the improper handling of user-supplied input within the makeRequest function of the src/index.ts file in the BaseConfigSchema component of PhialsBasement KoboldCPP-MCP-Server 1.0.0. Specifically, the function accepts the apiUrl argument without enforcing strict allowlisting, schema validation, or proper URL parsing semantics.\nThe attack flow proceeds as follows: an attacker crafts a malicious payload containing a modified or arbitrary Uniform Resource Identifier within the apiUrl parameter. When the application processes this configuration or executes the makeRequest function, it uses the unvalidated input to construct and dispatch an outbound HTTP request using internal server capabilities. Because the application blindly trusts the supplied endpoint, it can be manipulated to query loopback addresses (127.0.0.1 or localhost), internal microservices, cloud metadata endpoints (such as AWS IMDS), or restricted internal network resources that are otherwise inaccessible from the external perimeter.\nNetwork exposure parameters indicate that the attack can be launched on the local host. Depending on how the server binds its interfaces and exposes its configuration endpoints, local execution or interaction with the API is leveraged to trigger the SSRF vector. The affected version is explicitly limited to 1.0.0 of the KoboldCPP-MCP-Server project. Authentication and privilege requirements depend on the surrounding exposure of the MCP server interface, but the underlying root cause remains the absence of adequate destination validation inside the BaseConfigSchema implementation.\nPost-exploitation impact associated with this vulnerability includes internal reconnaissance, unauthorized data retrieval from internal services, interaction with vulnerable backend APIs, and potential execution of further service-specific attacks leveraging the trust boundary of the host running the vulnerable server instance."
}