mcp-searxng CVE-2026-54688
MEDIUM
GHSA-q87f-qc2r-2gw4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
No user interaction required in agentic/prompt-injection scenarios; Scope:Changed because server leverages its privileged network position to reach resources beyond the attacker's direct access.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694
Summary
The web_url_read tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard (assertUrlAllowed, which blocks private/loopback/metadata addresses) exists but runs only when MCP_HTTP_HARDEN=true, which is off by default. So in the default configuration there is no internal-address filtering, and an attacker who can influence the URL can make the server fetch internal services and cloud metadata and return their content. Confirmed on 1.1.0 (default config): web_url_read fetched a local internal sentinel and returned its content.
Details
dist/index.js (around lines 90-101): web_url_read calls fetchAndConvertToMarkdown on the caller URL. dist/url-reader.js (around lines 44-52): assertUrlAllowed performs the private-IP/loopback check, but only when the hardening flag is set; dist/http-security.js (around line 11) defaults MCP_HTTP_HARDEN to off. With the default config the check is skipped entirely. Even when enabled, the check is literal-hostname based with no DNS-rebinding or redirect re-check (the fetch follows redirects). file:// is rejected, so this is HTTP/HTTPS SSRF.
PoC
Re-validated on mcp-searxng 1.1.0 over MCP stdio in the default configuration (MCP_HTTP_HARDEN not set):
tools: searxng_web_search, web_url_read
web_url_read({ url: "http://127.0.0.1:<port>/internal" }) -> server fetched the internal sentinel; SSRF: CONFIRMEDThe server fetched the loopback sentinel and returned its content. With MCP_HTTP_HARDEN=true the same request is blocked (policy error), confirming the guard exists but ships off. The same reaches http://169.254.169.254/... on cloud hosts.
Impact
In the default configuration an attacker who can influence the URL (LLM-produced and steerable via prompt injection) can make the server fetch internal-only HTTP services and the cloud metadata endpoint, returning their contents into the model context for exfiltration. The protection that would prevent it is not enabled by default.
Remediation
Enable the internal-address filtering by default (fail safe): make assertUrlAllowed run unconditionally and require an explicit opt-out only for trusted environments. Strengthen the check to resolve the host and reject loopback, link-local/metadata (169.254.0.0/16), 0.0.0.0/8, and private ranges, and re-validate on every redirect hop (or pin to the validated IP).
AnalysisAI
Server-Side Request Forgery in mcp-searxng's web_url_read tool allows any caller - including an LLM steered via prompt injection - to make the server fetch internal HTTP services and cloud metadata endpoints (e.g., http://169.254.169.254/) and return their contents into the model context. The SSRF guard function assertUrlAllowed exists in the codebase but ships disabled because MCP_HTTP_HARDEN defaults to false, meaning all default deployments of versions prior to 1.2.1 are unprotected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The primary condition enabling exploitation is that MCP_HTTP_HARDEN is not set to true - this is the default out-of-the-box state, so all default deployments are vulnerable without any configuration change required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects the core risk accurately but arguably underscores the real-world danger in two ways: UI:R implies user interaction, yet in LLM agentic pipelines the tool invocation can be triggered automatically via prompt injection with no meaningful human gate, and S:U does not capture that the server uses its privileged internal network position to access resources the attacker could not reach directly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mcp-searxng v1.2.1, which is the vendor-released patch per https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.1 and the hotfix referenced in issue #91. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today