CVE-2026-58485: mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.

CVE-2026-58485 · Severity: high · CVSS 7.1 · Published 2026-09-15

mcp-searxng is a Node.js server that integrates the SearXNG search engine with Claude and other AI assistants via the Model Context Protocol. A DNS rebinding flaw in the web_url_read tool allows attackers to read arbitrary internal HTTP services without authentication by crafting a hostname that appears safe in syntactic checks but resolves to a private IP address (127.0.0.1, 10.0.0.0/8, etc.) at fetch time. This enables theft of sensitive data from internal services running on the server host.

Technologies: mcp-searxng (npm). Vendors: npm.

Quick answers

Is CVE-2026-58485 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58485 being exploited in the wild.
How severe is CVE-2026-58485?
High severity, with a CVSS score of 7.1, published 15 September 2026.
Which products and versions are affected?
mcp-searxng (npm) SEMVER:introduced=0,fixed=1.7.1.
Is there a fix for CVE-2026-58485?
Yes. mcp-searxng (npm): upgrade to 1.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58485 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58485?
Check whether you run mcp-searxng (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-searxng (npm): upgrade to 1.7.1 or later
    npm install mcp-searxng@1.7.1

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) caused by incomplete hostname validation in the assertUrlAllowed() function at src/url-reader.ts:85-93. The function validates the syntactic hostname string against a blocklist of private IP/hostname patterns but never performs actual DNS resolution. Since the OS-level DNS lookup happens later in undiciFetch() at src/url-reader.ts:367, an attacker can bypass the check by providing a domain (e.g., attacker.com or 127.0.0.1.nip.io) that resolves to a private/loopback address. No authentication is required in default HTTP mode (MCP_HTTP_HARDEN unset). The attack requires network connectivity to a DNS service the attacker controls or a public wildcard DNS provider, and the attacker must know which internal services are reachable from the server. The fix is to perform DNS resolution inside assertUrlAllowed() before the fetch, as shown in the advisory patch.

Affected products

  • ihor-sokoliuk mcp-searxng <=1.6.0

Identifiers

  • CVE-2026-58485
  • GHSA-mrvx-jmjw-vggc

Timeline

  • 2026-06-19: disclosed: Advisory published as GHSA-mrvx-jmjw-vggc
  • 2026-06-19: patched: Fix released in version 1.7.1
  • 2026-06-18: advisory: CVE-2026-58485 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.