mcp-searxng hardened-mode SSRF bypasses permit internal URL access
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ihor-sokoliuk | mcp-searxng | before 1.2.0 | 1.2.0 | Patch available | CNA |
| — | mcp-searxng (npm) | before 1.2.1 | 1.2.1 | Patch available | GHSA-wppf-h75h-6pm6 |
- mcp-searxng Vendorihor-sokoliuk Affected before 1.2.0 Fixed in 1.2.0 Patch available CNA
- mcp-searxng (npm) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-wppf-h75h-6pm6
Remediation
- Fix · CNA mcp-searxng (ihor-sokoliuk) Fixed in 1.2.0
- Fix · GHSA-wppf-h75h-6pm6 mcp-searxng (npm) Fixed in 1.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54689
- 2026-10-03 Alias added: GHSA-wppf-h75h-6pm6
References
Other 6
- https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-wppf-h75h-6pm6
- https://github.com/ihor-sokoliuk/mcp-searxng/pull/79
- https://github.com/ihor-sokoliuk/mcp-searxng/commit/48e5ecdcb4166a60b94c252dbe74b0a318110ac4
- https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.0
- https://github.com/ihor-sokoliuk/mcp-searxng
- https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.1
More ihor-sokoliuk vulnerabilities
- TI-2026-42087 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` CVSS 3.1HIGH 7.5
- TI-2026-42089 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read` CVSS 3.1HIGH 7.1
- TI-2026-39509 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-54689 · CVE Program
- CVE-2026-54689 · NVD
- FIRST EPSS
- GHSA-wppf-h75h-6pm6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences