CVE-2026-54688
Received Received - Intake

Server-Side Request Forgery in mcp-searxng

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, even though MCP_HTTP_HARDEN is disabled by default in src/http-security.ts. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context. file:// URLs remain rejected, and the separate DNS-resolution and redirect-validation bypasses are outside this record. This issue is fixed in version 1.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54688
EUVD
EUVD-2026-78923

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ihor-sokoliuk mcp-searxng to 1.2.0 (exc)
ihor-sokoliuk mcp-searxng to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in mcp-searxng versions prior to 1.2.0. The web_url_read function fetches user-supplied URLs but lacks proper internal-address filtering by default because the MCP_HTTP_HARDEN flag is disabled. An attacker can manipulate the URL to force the server to fetch internal services like localhost or cloud metadata endpoints and return their contents.

Detection Guidance

To detect this vulnerability, check if your mcp-searxng instance is running a version prior to 1.2.0. Verify the environment variable MCP_HTTP_HARDEN is not enabled by default. Test by attempting to fetch internal resources like 127.0.0.1 or 169.254.169.254 via the web_url_read tool.

Impact Analysis

An attacker could access sensitive internal services or cloud metadata endpoints through the vulnerable server. This could expose confidential data, internal network details, or cloud provider metadata. The impact is limited to data exposure as no code execution or privilege escalation is possible.

Mitigation Strategies

Upgrade mcp-searxng to version 1.2.0 or later. Ensure MCP_HTTP_ALLOW_PRIVATE_URLS is set to false (default) to block private/internal URL access. If internal access is required, explicitly set MCP_HTTP_ALLOW_PRIVATE_URLS=true after verifying security implications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart