CVE-2026-54689: mcp-searxng Auth Bypass Vulnerability

CVE-2026-54689 Overview

CVE-2026-54689 is a Server-Side Request Forgery (SSRF) bypass in mcp-searxng, a Model Context Protocol (MCP) server that provides AI assistants with web search and URL-reading capabilities through SearXNG. The web_url_read URL policy in src/url-reader.ts can be bypassed even when MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is disabled. An attacker-influenced tool call can coerce the MCP server into fetching loopback or internal HTTP resources. This exposes local services, private APIs, service-mesh endpoints, and cloud metadata endpoints. The issue is fixed in version 1.2.0.

Critical Impact

An attacker who can influence tool calls to the MCP server can retrieve content from internal HTTP resources, including cloud metadata endpoints that may expose credentials.

Affected Products

• mcp-searxng versions prior to 1.2.0
• MCP server deployments with MCP_HTTP_HARDEN enabled and MCP_HTTP_ALLOW_PRIVATE_URLS disabled
• AI assistant integrations relying on web_url_read for URL fetching

Discovery Timeline

• 2026-09-15 - CVE-2026-54689 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-54689

Vulnerability Analysis

The vulnerability [CWE-200] resides in the URL policy enforcement inside src/url-reader.ts. The policy is designed to block requests to private or internal addresses when MCP_HTTP_ALLOW_PRIVATE_URLS is not set. Three distinct enforcement gaps allow an attacker to bypass this control.

First, HTTP redirect targets are not revalidated against the private-address policy after the initial request resolves. Second, the address 0.0.0.0 is not classified as an internal address, allowing direct requests to that loopback alias. Third, IPv4-mapped IPv6 literals expressed in canonical hexadecimal form are not recognized as equivalent to their IPv4 counterparts.

Each gap allows a crafted URL or redirect chain to reach loopback or internal networks. The MCP server returns the response body to the calling AI assistant, exposing internal content.

Root Cause

The root cause is incomplete URL and address validation. The URL reader inspects only the initially supplied host and does not re-apply the private-address check when the HTTP client follows a redirect. The address classifier omits 0.0.0.0 and does not canonicalize IPv6 forms such as ::ffff:7f00:1 to their IPv4 equivalents before comparison.

Attack Vector

An attacker influences a tool call so the MCP server invokes web_url_read with a malicious URL. The URL can point to a hex-encoded IPv6-mapped loopback literal, to 0.0.0.0, or to an attacker-controlled host that returns a 3xx redirect toward an internal target. The server fetches the resource and returns the body, which may include cloud metadata such as instance credentials from 169.254.169.254, service-mesh sidecars, or private admin APIs.

// Patch excerpt from src/resources.ts (v1.2.0)
// - `MCP_HTTP_ALLOW_PRIVATE_URLS`: Allow `web_url_read` to fetch
//   private/internal URLs. Disabled by default in all modes.
//
// ### URL Reader Security
// `web_url_read` blocks private/internal URLs and redirects to
// private/internal URLs by default. Set
// `MCP_HTTP_ALLOW_PRIVATE_URLS=true` only when internal URL reads
// are intentional.

Source: GitHub Commit 48e5ecd

Detection Methods for CVE-2026-54689

Indicators of Compromise

• Outbound HTTP requests from the MCP server process targeting 127.0.0.0/8, 0.0.0.0, 169.254.169.254, RFC1918 ranges, or IPv6 loopback literals such as [::ffff:7f00:1].
• web_url_read tool invocations containing hex-encoded IPv6-mapped IPv4 literals or redirect chains that terminate on internal hosts.
• Cloud metadata service responses in MCP server logs or downstream AI assistant transcripts.

Detection Strategies

• Instrument the mcp-searxng process to log every resolved URL, including post-redirect targets, and flag any address falling within private, loopback, or link-local ranges.
• Deploy an egress proxy that denies traffic from the MCP server to internal CIDR blocks and alerts on blocked attempts.
• Correlate MCP tool-call telemetry with network flow data to identify suspicious pairings of web_url_read requests and internal endpoint access.

Monitoring Recommendations

• Monitor DNS and connection attempts from the MCP host to 169.254.169.254 and other cloud metadata IPs.
• Alert on HTTP responses to the MCP server containing IAM role names, instance identity tokens, or Kubernetes service account tokens.
• Track mcp-searxng package versions across deployments and alert on any release below 1.2.0.

How to Mitigate CVE-2026-54689

Immediate Actions Required

• Upgrade mcp-searxng to version 1.2.0 or later on every deployment.
• Confirm MCP_HTTP_ALLOW_PRIVATE_URLS is unset or explicitly false in production configurations.
• Audit recent web_url_read tool calls for attempts targeting loopback, 0.0.0.0, IPv6-mapped literals, or cloud metadata endpoints.

Patch Information

The fix is delivered in mcp-searxng v1.2.0. The patch revalidates redirect targets, classifies 0.0.0.0 as internal, and normalizes IPv4-mapped IPv6 literals before applying the private-address policy. Additional context is available in GHSA-wppf-h75h-6pm6 and Pull Request #79.

Workarounds

• Place the MCP server behind an egress proxy that blocks all outbound connections to private, loopback, and link-local address ranges.
• Run the MCP server in a network namespace or container without routes to internal services or the cloud metadata endpoint.
• Require IMDSv2 with hop-limit 1 on cloud instances to reduce the value of SSRF against metadata services.

# Upgrade to the patched release
npm install mcp-searxng@1.2.0

# Ensure private URL fetching remains disabled
unset MCP_HTTP_ALLOW_PRIVATE_URLS
# or explicitly:
export MCP_HTTP_ALLOW_PRIVATE_URLS=false