Server-Side Request Forgery in NocteDefensor LudusMCP Affects Version 1.0.24
CVE-2026-19367

5.3MEDIUM

Key Information:

Vendor

Noctedefensor

Status
Ludusmcp
Vendor
CVE Published:
9 August 2026

What is CVE-2026-19367?

A vulnerability exists in the NocteDefensor LudusMCP version 1.0.24, specifically within the read_range_config component's src/tools/rangeConfig.ts file. This flaw allows for server-side request forgery initiated remotely through manipulation of the 'Source' argument. Although the project was notified of the vulnerability, no response has been issued. Such vulnerabilities could lead to unauthorized access to internal services, making it imperative for users to take protective measures.

Affected Version(s)

LudusMCP 1.0.24

References

https://vuldb.com/vuln/387234
vdb-entrytechnical-description
https://vuldb.com/vuln/387234/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19367
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gongyanyu05 (VulDB User)
VulDB CNA Team
.