CVE-2026-54689
MediumCVSS 6.3Summary
mcp-searxng before version 1.2.0 has a vulnerability in the web_url_read URL policy that can be bypassed when MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled. The bypass is due to lack of revalidation of redirect targets, 0.0.0.0 not being classified as internal, and IPv4-mapped IPv6 literals in hexadecimal form not being recognized. An attacker can influence a tool call to make the MCP server fetch loopback or internal HTTP resources and return their content.
Risk Assessment
The organization may be exposed to data leakage from internal services, private APIs, service-mesh endpoints, or cloud metadata endpoints, potentially leading to confidentiality breaches.
Recommendation
It is recommended to immediately upgrade mcp-searxng to version 1.2.0 or later, which includes the fix.
Other vulnerabilities in mcp-searxng
See all- CVE-2026-58485High
In mcp-searxng before 1.7.1, web_url_read accepts a caller-controlled URL and validates only the literal hostname in assertUrlAllowed() before undiciFetch() performs OS DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can read internal services, expose credentials or tokens, and enumerate reachable internal hosts. Fixed in version 1.7.1.
- CVE-2026-58483High
In mcp-searxng before 1.7.1, web_url_read passes a caller-supplied URL to readUrlContent(), where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use, and the resulting string is processed by NodeHtmlMarkdown.translate(), increasing CPU consumption. An unauthenticated HTTP client can cause denial of service. Fixed in version 1.7.1.
- CVE-2026-54688Medium
mcp-searxng before version 1.2.0 has a vulnerability where web_url_read passes a caller-supplied URL to the server-side fetch path, and assertUrlAllowed() runs only when MCP_HTTP_HARDEN is enabled, which is disabled by default. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context.
Original NVD description (English source)
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.