Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-54689 medium CVSS 6.3

Information Disclosure in mcp-searxng (CVE-2026-54689)

Summary

Vulnerability in mcp-searxng (CVE-2026-54689). Confidential information can be exposed externally. Exploitable via web_url_read. Mitigation: upgrade to 1.2.1 or later.

Original description

The description as published by the source.

Summary

mcp-searxng has a hardened-mode URL-reading feature intended to prevent web_url_read from reaching private or internal network resources.

PR #79 appears to address one SSRF class: hostnames that resolve to private or internal addresses under hardened mode. I tested PR #79 locally and confirmed that it blocks the DNS-resolves-to-loopback case.

However, several other hardened-mode SSRF bypasses still appear to remain:

  1. Redirects from an allowed first-hop URL to a loopback/internal URL are followed without re-validating the redirect target.
  2. 0.0.0.0 is not treated as an internal/special address.
  3. IPv4-mapped IPv6 literals can bypass private-address checks after URL canonicalization.

With hardened mode enabled and private URLs not explicitly allowed, web_url_read was still able to fetch and return content from a local loopback sentinel service in all three cases.

Tested configuration

MCP_HTTP_HARDEN=true
MCP_HTTP_ALLOW_PRIVATE_URLS unset

The MCP server was driven over stdio.

The test target was a harmless internal sentinel HTTP service bound to:

127.0.0.1:6789

The sentinel response contained:

INTERNAL_SECRET_DATA__mcp_searxng_ssrf_path2

Relationship to PR #79

I tested PR #79 locally:

  • PR: fix(url-reader): block DNS-rebinding SSRF via socket-level lookup guard (CWE-918) #79
  • PR commit tested: e55d28e7be6786a71cd7a0eaf13d3ec9d0b734d4
  • Base issue class: CWE-918 / SSRF in web_url_read
  • Hardene…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-54689 has been found in mcp-searxng.
Attackers can target a specific entry point like web_url_read over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 6.3/10.
What to do: upgrade mcp-searxng to 1.2.1 or later.
If unsure, ask your IT team or search "mcp-searxng CVE-2026-54689" on the vendor's site.

CVE-2026-54689 (mcp-searxng) — CWE-200 / CVSS v3 6.3
Attack vector: local / unauthenticated
Attack surface: web_url_read / e55d28e7be6786a71cd7a0eaf13d3ec9d0b734d4 / curl / NodeHtmlMarkdown
Patched: 1.2.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Information disclosure (CWE-200) exists in mcp-searxng. Attackers reach the vulnerable code path via web_url_read without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of mcp-searxng. Attack surface: web_url_read / e55d28e7be6786a71cd7a0eaf13d3ec9d0b734d4 / curl / NodeHtmlMarkdown.

🔥 Severity

Severity: Medium (CVSS 6.3/10). Confidential information can be exposed externally.

🔧 How to fix

Update to 1.2.1.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'mcp-searxng' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'mcp-searxng' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で mcp-searxng を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade mcp-searxng to 1.2.1

    ステージング環境で 1.2.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm mcp-searxng
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details