Executive brief
The SearXNG MCP Server includes a tool that fetches web pages from URLs provided by users and converts them to markdown. A security check designed to block requests to internal services and cloud metadata endpoints exists in the code but is disabled by default. An attacker who can inject URLs (through prompt injection to an AI model using this tool) can make the server fetch internal-only services or cloud credentials, exposing sensitive data.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the web_url_read tool. The tool calls fetchAndConvertToMarkdown (dist/index.js lines 90-101) with a caller-supplied URL. A protective function assertUrlAllowed (dist/url-reader.js lines 44-52) blocks requests to private IPs, loopback addresses (127.0.0.1), and cloud metadata endpoints (169.254.169.254), but this check runs only when the environment variable MCP_HTTP_HARDEN is set to true. The default configuration (dist/http-security.js line 11) has MCP_HTTP_HARDEN off, so the guard is completely bypassed. Additionally, the check is hostname-based without DNS rebinding protection or re-validation on redirects. File URLs are blocked, limiting the attack to HTTP/HTTPS. A PoC on version 1.1.0 confirmed the vulnerability: requests to http://127.0.0.1:<port>/internal successfully fetched internal sentinels. Version 1.2.1 and later patch this issue.
Affected products
- ihor-sokoliuk mcp-searxng < 1.2.1
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database
- 2026-08-19: patched: Version 1.2.1 released with fix
- 2026-08-19: advisory: GHSA-q87f-qc2r-2gw4 and CVE-2026-54688 published