Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-54689mcp-searxng hardened-mode SSRF bypasses permit internal URL access

Medium 6.3

In plain English

A medium-severity information exposure in mcp-searxng from ihor-sokoliuk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmmcp-searxng1.2.1GHSA-wppf-h75h-6pm6

Affected products (as reported)

VendorProductVersions
ihor-sokoliuk mcp-searxng < 1.2.0

Weakness: CWE-200, CWE-918 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References