CVE-2026-54689: mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.

CVE-2026-54689 · Severity: medium · CVSS 6.3 · Published 2026-09-15

The SearXNG MCP Server is a tool integration that allows AI assistants to read and fetch content from URLs. When configured in hardened mode to block access to internal services, the `web_url_read` feature can still reach private loopback addresses through three distinct bypasses: HTTP redirects from public IPs to private addresses are followed without re-validation, special IPv4 addresses like 0.0.0.0 are not blocked, and IPv4-mapped IPv6 address literals bypass existing filters. An attacker who can influence tool selection or provide URLs could access local admin panels, internal APIs, Redis instances, or cloud metadata endpoints.

Technologies: mcp-searxng (npm). Vendors: npm.

Quick answers

Is CVE-2026-54689 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54689 being exploited in the wild.
How severe is CVE-2026-54689?
Medium severity, with a CVSS score of 6.3, published 15 September 2026.
Which products and versions are affected?
mcp-searxng (npm) < 1.2.1, SEMVER:introduced=0,fixed=1.2.1.
Is there a fix for CVE-2026-54689?
Yes. mcp-searxng (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54689 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54689?
Check whether you run mcp-searxng (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-searxng (npm): upgrade to 1.2.1 or later
    npm install mcp-searxng@1.2.1

Technical details

This is a server-side request forgery (SSRF) vulnerability in the `web_url_read` tool of the mcp-searxng MCP server. Even with hardened mode enabled, three distinct bypass classes remain after the initial DNS-rebinding fix (PR #79). First, redirect validation is missing: the initial URL is checked against the private-address policy, but HTTP 3xx redirects are followed without re-validating the `Location` header target, allowing pivots from public IPs to internal services. Second, the special address 0.0.0.0 is not blocked; on Linux this address routes to local services on loopback or wildcard interfaces. Third, IPv4-mapped IPv6 literals bypass existing regex filters: Node's WHATWG URL parser canonicalizes `[::ffff:127.0.0.1]` to `[::ffff:7f00:1]` (hex representation), defeating string-matching logic that expects the dotted-decimal form. The attack vector is network-accessible and requires only the ability to control or influence which URLs the MCP tool processes—a realistic concern for AI-assisted tool selection. Patched in version 1.2.1.

Affected products

  • ihor-sokoliuk mcp-searxng < 1.2.1

Identifiers

  • CVE-2026-54689
  • GHSA-wppf-h75h-6pm6

Timeline

  • 2026-06-11: disclosed: GitHub advisory GHSA-wppf-h75h-6pm6 published
  • 2026-08-19: patched: Version 1.2.1 released with fixes for all three bypass classes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.