CVE-2026-58485
Received Received - Intake

Path Traversal in mcp-searxng

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed() within src/url-reader.ts before undiciFetch() performs operating-system DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address therefore passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can use this path to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments, prompt-influenced tool selection can provide the malicious URL. Direct private IP literals are blocked, and MCP_HTTP_ALLOW_PRIVATE_URLS remains an explicit opt-out. This issue is fixed in version 1.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-58485
EUVD
EUVD-2026-78924

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ihor-sokoliuk mcp-searxng 1.7.1
ihor-sokoliuk mcp-searxng to 1.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

mcp-searxng is a Model Context Protocol server that provides AI assistants with web search and URL reading via SearXNG. Prior to version 1.7.1, the vulnerability exists in how it handles URLs. The server validates only the hostname part of a user-controlled URL before fetching it. An attacker can exploit this by providing a hostname that appears public but resolves to a private, loopback, or internal address. This bypasses the lexical check and allows the server to connect to internal services, potentially exposing sensitive data or enabling internal host enumeration.

Detection Guidance

Check if your mcp-searxng instance is running version 1.7.1 or later. Inspect network logs for outbound connections to private, loopback, or link-local addresses originating from the MCP server. Monitor for unusual URL parsing or DNS resolution requests that bypass hostname validation.

Impact Analysis

If you use mcp-searxng versions before 1.7.1, an attacker could trick the server into connecting to internal services within your network. This could lead to exposure of credentials, service tokens, or internal service data. In HTTP deployments, unauthenticated attackers might read internal services. In STDIO deployments, prompt-influenced tool selection could provide malicious URLs. Direct private IP literals are blocked, but MCP_HTTP_ALLOW_PRIVATE_URLS can disable this protection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of credentials or internal service data may result in data breaches, triggering compliance violations, regulatory fines, and reputational damage. Organizations must ensure prompt patching to maintain compliance with data protection standards.

Mitigation Strategies

Upgrade mcp-searxng to version 1.7.1 or later immediately. Disable MCP_HTTP_ALLOW_PRIVATE_URLS if enabled. Restrict network access to the MCP server to prevent unauthenticated external connections. Review internal services for unauthorized access or data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart