CVE-2026-19337: adenot mcp-google-search SSRF Vulnerability

CVE-2026-19337 Overview

CVE-2026-19337 is a Server-Side Request Forgery (SSRF) vulnerability in the adenot mcp-google-search Model Context Protocol (MCP) server, affecting versions up to 0.3.1. The flaw resides in the read_webpage component within src/index.ts, where the url argument passed to the tool is not validated against internal network destinations. An attacker with local access to the MCP server can manipulate the URL parameter to force the process to issue HTTP requests to private-network addresses. The issue is tracked under CWE-918 and has been addressed in commit f071d491b685011ca04e8ab8d586fc65f86bcee1.

Critical Impact
A local attacker can abuse the read_webpage MCP tool to reach private-network services reachable from the MCP host, enabling reconnaissance and interaction with internal-only endpoints.

Affected Products

adenot mcp-google-search versions up to and including 0.3.1
The read_webpage tool exposed by the MCP server
Deployments of MCP clients that invoke mcp-google-search with attacker-influenced URL input

Discovery Timeline

2026-08-09 - CVE-2026-19337 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19337

Vulnerability Analysis

The mcp-google-search project exposes a read_webpage tool that accepts a URL and fetches the target page using axios before parsing it with cheerio. Prior to the fix, the URL argument was not screened for hostnames or IP addresses that resolve to private, loopback, or link-local ranges. A caller supplying a URL such as http://127.0.0.1:8080/ or http://169.254.169.254/ causes the MCP server process to originate the outbound request, returning response content back through the MCP channel. The impact is bounded by the local attack vector: the attacker must already be able to invoke the MCP tool, typically through an MCP client on the same host or via a compromised agent workflow.

Root Cause

The root cause is missing destination validation on user-controlled input. The read_webpage handler forwards the url argument directly to axios, without performing DNS resolution and rejecting private-network LookupAddress results. This maps to CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires local invocation of the MCP tool with low privileges. An attacker crafts a read_webpage call whose url argument targets an internal service such as a cloud metadata endpoint, an unauthenticated admin interface, or a service bound to localhost. The MCP process performs the request and returns the parsed content to the caller, disclosing information from services the attacker cannot reach directly.

typescript

 import axios, { AxiosProxyConfig } from 'axios';
 import * as cheerio from 'cheerio';
 import { URL } from 'url';
+import dns from 'dns';
+import { LookupAddress } from 'net';
 
 const API_KEY = process.env.GOOGLE_API_KEY;
 const SEARCH_ENGINE_ID = process.env.GOOGLE_SEARCH_ENGINE_ID;
// Source: https://github.com/adenot/mcp-google-search/commit/f071d491b685011ca04e8ab8d586fc65f86bcee1
// The patch introduces DNS resolution via `dns` and `LookupAddress` typing so that resolved addresses can be checked against private ranges before axios issues the request.

Detection Methods for CVE-2026-19337

Indicators of Compromise

Outbound HTTP requests from the mcp-google-search process to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) destinations.
MCP tool invocations of read_webpage where the url argument references cloud metadata services such as 169.254.169.254 or internal hostnames.
Log entries in the MCP server showing successful fetches of hosts that are not public web endpoints.

Detection Strategies

Instrument the read_webpage handler to log the resolved IP address for every fetch and alert when it falls within reserved ranges.
Correlate process-level network telemetry from the Node.js runtime hosting mcp-google-search with a deny-list of internal CIDRs.
Review MCP client transcripts for prompts or tool arguments that reference localhost, 127.0.0.1, or metadata IPs.

Monitoring Recommendations

Capture egress connections from the MCP host and route them through a filtering proxy that blocks private destinations.
Enable audit logging of MCP tool calls and retain the full argument payload for post-incident review.
Monitor for unexpected version pinning of mcp-google-search below 0.3.1 in package manifests.

How to Mitigate CVE-2026-19337

Immediate Actions Required

Update mcp-google-search to a release that includes commit f071d491b685011ca04e8ab8d586fc65f86bcee1.
Restrict which principals can invoke the MCP server, ensuring only trusted local users and agents can call read_webpage.
Place the MCP host on a network segment that has no route to sensitive internal services or cloud metadata endpoints.

Patch Information

The upstream fix is applied in commit f071d491b685011ca04e8ab8d586fc65f86bcee1 on the adenot/mcp-google-search repository, tracked via Issue #11 and Pull Request #13. The patch adds DNS resolution using the Node.js dns module and the LookupAddress type from net to reject URLs whose resolved addresses fall within private-network ranges before axios performs the request. Additional details are available in the VulDB entry for CVE-2026-19337.

Workarounds

Front the MCP host with an egress proxy such as squid configured to deny requests to RFC1918, loopback, and link-local destinations.
Wrap read_webpage invocations in an allow-list that only permits URLs matching approved public domains.
Disable or remove the read_webpage tool from the MCP server configuration if it is not required by downstream agents.

bash

# Upgrade the package to a fixed version once published
npm install mcp-google-search@latest

# Verify the installed version no longer matches the vulnerable range (<= 0.3.1)
npm ls mcp-google-search

# Example iptables rule to block egress to cloud metadata from the MCP host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT