CVE-2026-54688: mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.

CVE-2026-54688 · Severity: medium · CVSS 6.5 · Published 2026-09-15

The SearXNG MCP Server includes a tool that fetches web pages from URLs provided by users and converts them to markdown. A security check designed to block requests to internal services and cloud metadata endpoints exists in the code but is disabled by default. An attacker who can inject URLs (through prompt injection to an AI model using this tool) can make the server fetch internal-only services or cloud credentials, exposing sensitive data.

Technologies: mcp-searxng (npm). Vendors: npm.

Quick answers

Is CVE-2026-54688 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54688 being exploited in the wild.
How severe is CVE-2026-54688?
Medium severity, with a CVSS score of 6.5, published 15 September 2026.
Which products and versions are affected?
mcp-searxng (npm) < 1.2.1, SEMVER:introduced=0,fixed=1.2.1.
Is there a fix for CVE-2026-54688?
Yes. mcp-searxng (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54688 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54688?
Check whether you run mcp-searxng (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-searxng (npm): upgrade to 1.2.1 or later
    npm install mcp-searxng@1.2.1

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the web_url_read tool. The tool calls fetchAndConvertToMarkdown (dist/index.js lines 90-101) with a caller-supplied URL. A protective function assertUrlAllowed (dist/url-reader.js lines 44-52) blocks requests to private IPs, loopback addresses (127.0.0.1), and cloud metadata endpoints (169.254.169.254), but this check runs only when the environment variable MCP_HTTP_HARDEN is set to true. The default configuration (dist/http-security.js line 11) has MCP_HTTP_HARDEN off, so the guard is completely bypassed. Additionally, the check is hostname-based without DNS rebinding protection or re-validation on redirects. File URLs are blocked, limiting the attack to HTTP/HTTPS. A PoC on version 1.1.0 confirmed the vulnerability: requests to http://127.0.0.1:&lt;port&gt;/internal successfully fetched internal sentinels. Version 1.2.1 and later patch this issue.

Affected products

  • ihor-sokoliuk mcp-searxng < 1.2.1

Identifiers

  • CVE-2026-54688
  • GHSA-q87f-qc2r-2gw4

Timeline

  • 2026-06-11: disclosed: Published to GitHub Advisory Database
  • 2026-08-19: patched: Version 1.2.1 released with fix
  • 2026-08-19: advisory: GHSA-q87f-qc2r-2gw4 and CVE-2026-54688 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.