CVE-2026-54689
Received Received - Intake

mcp-searxng URL Policy Bypass Leading to Internal Resource Access

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54689
EUVD
EUVD-2026-78921

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ihor_sokoliuk mcp-searxng 1.2.0
ihor_sokoliuk mcp-searxng to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects mcp-searxng, a tool that allows AI assistants to perform web searches and read URLs via SearXNG. The issue is in the URL policy for web_url_read, which can be bypassed even with security settings enabled. Attackers can exploit this to make the MCP server fetch internal or loopback HTTP resources, potentially exposing local services or private APIs.

Detection Guidance

To detect this vulnerability, check if your mcp-searxng instance is running a version prior to 1.2.0. Run the command: mcp-searxng --version. If the version is below 1.2.0, the system is vulnerable.

Impact Analysis

An attacker could use this flaw to access sensitive internal services, private APIs, or cloud metadata endpoints through the MCP server. This could lead to unauthorized data exposure, service disruption, or further attacks on internal systems if the MCP server has access to them.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling protected information.

Mitigation Strategies

Upgrade mcp-searxng to version 1.2.0 or later immediately. This version includes fixes for the URL policy bypass. Use the command: pip install --upgrade mcp-searxng.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart