Executive brief
The SearXNG MCP Server is a tool integration that allows AI assistants to read and fetch content from URLs. When configured in hardened mode to block access to internal services, the `web_url_read` feature can still reach private loopback addresses through three distinct bypasses: HTTP redirects from public IPs to private addresses are followed without re-validation, special IPv4 addresses like 0.0.0.0 are not blocked, and IPv4-mapped IPv6 address literals bypass existing filters. An attacker who can influence tool selection or provide URLs could access local admin panels, internal APIs, Redis instances, or cloud metadata endpoints.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the `web_url_read` tool of the mcp-searxng MCP server. Even with hardened mode enabled, three distinct bypass classes remain after the initial DNS-rebinding fix (PR #79). First, redirect validation is missing: the initial URL is checked against the private-address policy, but HTTP 3xx redirects are followed without re-validating the `Location` header target, allowing pivots from public IPs to internal services. Second, the special address 0.0.0.0 is not blocked; on Linux this address routes to local services on loopback or wildcard interfaces. Third, IPv4-mapped IPv6 literals bypass existing regex filters: Node's WHATWG URL parser canonicalizes `[::ffff:127.0.0.1]` to `[::ffff:7f00:1]` (hex representation), defeating string-matching logic that expects the dotted-decimal form. The attack vector is network-accessible and requires only the ability to control or influence which URLs the MCP tool processes—a realistic concern for AI-assisted tool selection. Patched in version 1.2.1.
Affected products
- ihor-sokoliuk mcp-searxng < 1.2.1
Timeline
- 2026-06-11: disclosed: GitHub advisory GHSA-wppf-h75h-6pm6 published
- 2026-08-19: patched: Version 1.2.1 released with fixes for all three bypass classes