CVE-2026-42260: Open-WebSearch SSRF Vulnerability

CVE-2026-42260 Overview

CVE-2026-42260 is a Server-Side Request Forgery (SSRF) vulnerability in Open-WebSearch, a multi-engine Model Context Protocol (MCP) server, CLI, and local daemon used for agent web search and content retrieval. Versions prior to 2.1.7 ship URL safety checks in src/utils/urlSafety.ts that fail to recognize bracketed IPv6 literals and do not resolve DNS names before fetching. Attackers can supply crafted URLs that bypass isPublicHttpUrl and assertPublicHttpUrl, causing the daemon to issue requests to internal hosts. The response body is returned to the caller, making this a non-blind SSRF [CWE-918]. The flaw is fixed in version 2.1.7.

Critical Impact
Unauthenticated attackers can reach internal network services through the Open-WebSearch daemon and read responses, exposing cloud metadata endpoints, internal APIs, and other restricted resources.

Affected Products

Open-WebSearch MCP server versions prior to 2.1.7
Open-WebSearch CLI versions prior to 2.1.7
Open-WebSearch local daemon versions prior to 2.1.7

Discovery Timeline

2026-05-12 - CVE-2026-42260 published to the National Vulnerability Database (NVD)
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42260

Vulnerability Analysis

Open-WebSearch exposes URL fetching primitives that agents and clients invoke to retrieve web content. To prevent requests against internal infrastructure, the project implements isPublicHttpUrl and assertPublicHttpUrl helpers in src/utils/urlSafety.ts. These helpers are responsible for rejecting URLs that resolve to private, loopback, or link-local addresses.

The checks operate on the raw URL string without parsing bracketed IPv6 literals such as http://[::1]/ or http://[fe80::1]/. Requests targeting these literals pass validation and are dispatched by the HTTP client. The helpers also skip DNS resolution, so a hostname pointing to 127.0.0.1, 169.254.169.254, or other internal addresses is treated as public. The response body is returned to the requester, turning the daemon into a non-blind SSRF proxy.

Root Cause

The root cause is incomplete input validation in the URL safety layer. The implementation does not normalize IPv6 bracket notation into a numeric address before comparing against blocklists. It also performs no DNS lookup of hostnames before dispatch, leaving a gap between policy decision and HTTP request.

Attack Vector

An attacker submits a fetch request containing either a bracketed IPv6 literal pointing to an internal interface, or a hostname that resolves to an internal address. The validator approves the URL, the HTTP client connects to the internal target, and the daemon returns the full response body to the caller. No authentication is required, and the network attack vector permits remote exploitation.

The vulnerability is described in prose because no public proof-of-concept code has been released. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-42260

Indicators of Compromise

Outbound HTTP requests from the Open-WebSearch process to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254
Requests originating from the daemon to bracketed IPv6 literals such as [::1], [fe80::/10], or [fc00::/7]
Unusual access patterns to cloud instance metadata endpoints correlated with Open-WebSearch activity
HTTP request logs containing user-supplied URLs with IPv6 bracket notation

Detection Strategies

Inspect Open-WebSearch access logs for fetch parameters containing IPv6 literals or hostnames that resolve to internal addresses
Apply egress firewall rules that log and alert on any connection from the daemon host to private address space
Hunt for the Open-WebSearch process retrieving content from cloud metadata services or service mesh endpoints

Monitoring Recommendations

Forward daemon HTTP client logs and host network telemetry to a centralized SIEM for correlation
Track the installed Open-WebSearch version across hosts and alert on any deployment below 2.1.7
Monitor MCP client request payloads for URL parameters that include bracket characters or numeric IPv6 forms

How to Mitigate CVE-2026-42260

Immediate Actions Required

Upgrade Open-WebSearch to version 2.1.7 or later on every MCP server, CLI installation, and local daemon
Restrict the daemon's outbound network access using host firewalls or network policy to block private address ranges
Audit recent request logs for evidence of SSRF probing against internal services or cloud metadata endpoints

Patch Information

The maintainers fixed the issue in Open-WebSearch 2.1.7 by hardening isPublicHttpUrl and assertPublicHttpUrl in src/utils/urlSafety.ts. Refer to the GitHub Security Advisory GHSA-v228-72c7-fx8j for the patch commit and release notes.

Workarounds

Place the daemon in a network segment with no route to internal services or cloud metadata endpoints
Configure an outbound HTTP proxy that enforces an allowlist of public destinations
Disable user-controlled URL fetching features until the upgrade to 2.1.7 is complete

bash

# Configuration example: block egress to private and metadata ranges with iptables
iptables -A OUTPUT -m owner --uid-owner open-websearch -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-websearch -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-websearch -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-websearch -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-websearch -d 169.254.0.0/16 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner open-websearch -d ::1/128 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner open-websearch -d fc00::/7 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner open-websearch -d fe80::/10 -j REJECT