CVE-2026-54689Medium· 6.3▾ TwilightPoC availablemcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is en…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Exploit / PoC code exists
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mcp-searxng < 1.2.1Patched in:
mcp-searxng 1.2.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54688Medium· 6.5mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
CVE-2026-58485High· 7.1mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
GHSA-mrvx-jmjw-vggcHigh· 7.1SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
CVE-2026-58483High· 7.5mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
GHSA-hjwh-xvfw-qrwjMedium· 5.5SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
GHSA-xcqx-9jf5-w339High· 7.5SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`