Executive brief
The SearXNG Model Context Protocol (MCP) server, which allows AI agents to interact with the SearXNG search engine, contains a security flaw in its web page reading tool. An attacker can trick the server into accessing sensitive internal network services, such as cloud metadata or private databases, that are normally protected from the public internet. This could lead to the theft of administrative credentials or private company data.
Technical details
The `web_url_read` tool in `mcp-searxng` is vulnerable to SSRF via DNS rebinding or malicious DNS resolution. The `assertUrlAllowed()` function in `src/url-reader.ts` performs a lexical string comparison of the hostname against a blocklist of private IP ranges but does not resolve the hostname to its underlying IP address before validation. Consequently, an attacker can provide a domain name that appears public but resolves to a loopback (127.0.0.1) or private IP address. The subsequent fetch operation (using `undiciFetch`) resolves the DNS and connects to the internal resource. In default configurations where `MCP_HTTP_HARDEN` is unset, no authentication is required to trigger this behavior. The issue is fixed in version 1.7.1 by implementing DNS lookup during the validation phase.
Affected products
- ihor-sokoliuk mcp-searxng < 1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 1.7.1