CVE-2026-19367CWE-918ssrf

CVE-2026-19367

Medium · published August 10, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component read_range_config. The manipulation of the argument Source leads to server-side request forgery. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-10T00:16Z
References (7)
https://github.com/NocteDefensor/LudusMCP/ · [email protected]https://github.com/NocteDefensor/LudusMCP/issues/6 · [email protected]https://vuldb.com/cve/CVE-2026-19367 · [email protected]https://vuldb.com/submit/866263 · [email protected]https://vuldb.com/vuln/387234 · [email protected]https://vuldb.com/vuln/387234/cti · [email protected]https://github.com/NocteDefensor/LudusMCP/issues/6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 AUG 20:00Z
    NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery
    cvelistv5