Executive brief
mcp-searxng is a Node.js server that integrates the SearXNG search engine with Claude and other AI assistants via the Model Context Protocol. A DNS rebinding flaw in the web_url_read tool allows attackers to read arbitrary internal HTTP services without authentication by crafting a hostname that appears safe in syntactic checks but resolves to a private IP address (127.0.0.1, 10.0.0.0/8, etc.) at fetch time. This enables theft of sensitive data from internal services running on the server host.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) caused by incomplete hostname validation in the assertUrlAllowed() function at src/url-reader.ts:85-93. The function validates the syntactic hostname string against a blocklist of private IP/hostname patterns but never performs actual DNS resolution. Since the OS-level DNS lookup happens later in undiciFetch() at src/url-reader.ts:367, an attacker can bypass the check by providing a domain (e.g., attacker.com or 127.0.0.1.nip.io) that resolves to a private/loopback address. No authentication is required in default HTTP mode (MCP_HTTP_HARDEN unset). The attack requires network connectivity to a DNS service the attacker controls or a public wildcard DNS provider, and the attacker must know which internal services are reachable from the server. The fix is to perform DNS resolution inside assertUrlAllowed() before the fetch, as shown in the advisory patch.
Affected products
- ihor-sokoliuk mcp-searxng <=1.6.0
Timeline
- 2026-06-19: disclosed: Advisory published as GHSA-mrvx-jmjw-vggc
- 2026-06-19: patched: Fix released in version 1.7.1
- 2026-06-18: advisory: CVE-2026-58485 assigned