CVE-2026-54688: mcp-searxng SSRF Vulnerability

CVE-2026-54688 Overview

CVE-2026-54688 is a Server-Side Request Forgery (SSRF) vulnerability in mcp-searxng, a Model Context Protocol (MCP) server that provides AI assistants with web search and URL-reading capabilities through SearXNG. The web_url_read tool passes caller-supplied URLs to the server-side fetch path without validation in the default configuration. The assertUrlAllowed() check in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, but that flag is disabled by default in src/http-security.ts. Attackers who influence the URL chosen by a user or AI agent can force the server to fetch internal resources. The issue is fixed in version 1.2.0 [CWE-918].

Critical Impact
Attackers can coerce the MCP server to fetch loopback, private-network, and cloud metadata endpoints, returning sensitive internal data into the AI model context.

Affected Products

mcp-searxng versions prior to 1.2.0
Deployments running with default MCP_HTTP_HARDEN configuration
AI assistants and agents relying on mcp-searxng for URL reading

Discovery Timeline

2026-09-15 - CVE-2026-54688 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54688

Vulnerability Analysis

The vulnerability exists in the web_url_read tool exposed by mcp-searxng. This tool accepts arbitrary URLs from callers and passes them directly to the server-side fetch implementation. The URL validation function assertUrlAllowed() in src/url-reader.ts is gated behind the MCP_HTTP_HARDEN environment variable. Because src/http-security.ts sets MCP_HTTP_HARDEN to disabled by default, out-of-the-box installations perform no SSRF validation before making HTTP requests.

An attacker who can influence the URL parameter — for example through prompt injection against the AI agent — can force the server to request loopback addresses like http://127.0.0.1, RFC 1918 private-network ranges, or cloud instance metadata endpoints such as http://169.254.169.254/latest/meta-data/. The response body is then returned into the model context, exposing internal service data, credentials, and cloud IAM tokens.

Root Cause

The root cause is an insecure default configuration combined with conditional input validation. The security-critical assertUrlAllowed() guard is only executed when hardening is explicitly enabled, inverting the secure-by-default principle. The file:// scheme is rejected unconditionally, but HTTP(S) requests to internal targets are permitted.

Attack Vector

Exploitation requires user interaction, typically through an AI agent that consumes attacker-controlled content containing a crafted URL. No authentication is required against the MCP server itself. Related DNS-resolution and redirect-validation bypasses are tracked separately.

typescript

// Patch excerpt from src/resources.ts and README
// Source: https://github.com/ihor-sokoliuk/mcp-searxng/commit/48e5ecdcb4166a60b94c252dbe74b0a318110ac4
- `HTTP_PROXY` / `HTTPS_PROXY`: Proxy server configuration
- `NO_PROXY` / `no_proxy`: Comma-separated list of hosts to bypass proxy
- `MCP_HTTP_PORT`: Enable HTTP transport on specified port
+ `MCP_HTTP_ALLOW_PRIVATE_URLS`: Allow `web_url_read` to fetch
+   private/internal URLs. Disabled by default in all modes.
+
+### URL Reader Security
+`web_url_read` blocks private/internal URLs and redirects to
+ private/internal URLs by default. Set
+ `MCP_HTTP_ALLOW_PRIVATE_URLS=true` only when internal URL reads
+ are intentional.

The patch inverts the default: private and internal URL fetches are now blocked unless the operator explicitly opts in via MCP_HTTP_ALLOW_PRIVATE_URLS=true. See the GitHub Security Advisory GHSA-q87f-qc2r-2gw4 for full technical details.

Detection Methods for CVE-2026-54688

Indicators of Compromise

Outbound HTTP requests from the mcp-searxng process to loopback addresses (127.0.0.0/8, ::1) or RFC 1918 ranges.
Requests to cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Unexpected web_url_read tool invocations containing internal hostnames or IP literals in MCP transport logs.

Detection Strategies

Inspect MCP request logs for web_url_read calls with URLs targeting private address space or link-local ranges.
Correlate AI agent prompts containing untrusted external content with subsequent internal HTTP fetches by the server.
Deploy egress traffic analysis to flag any host process making unexpected requests to metadata service IPs.

Monitoring Recommendations

Enable verbose logging on the mcp-searxng process and forward events to a centralized SIEM for correlation.
Configure alerts on connections from the server workload to cloud instance metadata endpoints.
Track version strings in deployed MCP servers and alert on any instance running a release earlier than 1.2.0.

How to Mitigate CVE-2026-54688

Immediate Actions Required

Upgrade mcp-searxng to version 1.2.0 or later immediately across all deployments.
Audit environment variables and confirm MCP_HTTP_ALLOW_PRIVATE_URLS is not set to true unless internal reads are required.
Restrict outbound network access from the mcp-searxng workload to only the destinations SearXNG needs.

Patch Information

The fix ships in mcp-searxng v1.2.0 via commit 48e5ecd. The patch enforces assertUrlAllowed() by default, blocking private-network and loopback URLs unless the operator explicitly opts in with MCP_HTTP_ALLOW_PRIVATE_URLS=true. Refer to the GitHub issue discussion for background.

Workarounds

If patching is delayed, enforce network-layer egress controls that deny traffic from the server to RFC 1918, loopback, and link-local ranges.
Block access to cloud metadata endpoints (169.254.169.254) at the host firewall or via IMDSv2 with session tokens on AWS.
Run the mcp-searxng process in an isolated network namespace or container with a restricted outbound policy.

bash

# Configuration example - enforce hardened defaults after upgrading to v1.2.0
unset MCP_HTTP_ALLOW_PRIVATE_URLS
export MCP_HTTP_HARDEN=true

# Optional: block metadata endpoint at the host firewall
iptables -A OUTPUT -d 169.254.169.254 -j DROP