EXECUTIVE SUMMARY:
The mcp-searxng package contains two Server-Side Request Forgery (SSRF) vulnerabilities in the web_url_read functionality, which allows the MCP server to fetch and convert user-controlled URLs into markdown content. The first issue occurs because SSRF protections are disabled by default, allowing attackers to access internal services, loopback interfaces, and cloud metadata endpoints through crafted URLs. The second issue affects hardened mode, where additional bypasses remain possible due to incomplete URL validation, including redirect-based SSRF, 0.0.0.0 access, and IPv4-mapped IPv6 address handling flaws. Successful exploitation could allow attackers to retrieve sensitive internal resources, access administrative services, or expose cloud credentials from metadata services. The vulnerabilities have been addressed by strengthening SSRF protections and improving internal network access validation.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
The mcp-searxng package contains two Server-Side Request Forgery (SSRF) vulnerabilities in the web_url_read functionality, which allows the MCP server to fetch and convert user-controlled URLs into markdown content. The first issue occurs because SSRF protections are disabled by default, allowing attackers to access internal services, loopback interfaces, and cloud metadata endpoints through crafted URLs. The second issue affects hardened mode, where additional bypasses remain possible due to incomplete URL validation, including redirect-based SSRF, 0.0.0.0 access, and IPv4-mapped IPv6 address handling flaws. Successful exploitation could allow attackers to retrieve sensitive internal resources, access administrative services, or expose cloud credentials from metadata services. The vulnerabilities have been addressed by strengthening SSRF protections and improving internal network access validation.[emaillocker id="1283"]
CVE-2026-54688 (CVSS 6.5 — Medium): A SSRF vulnerability exists due to the internal-address guard being disabled by default in web_url_read. An attacker who can influence the URL can make the server fetch internal services and cloud metadata, returning their content for exfiltration.
CVE-2026-54689 (CVSS 6.3 — Medium): Additional hardened-mode SSRF bypasses are present, allowing redirects from an allowed first-hop URL to a loopback/internal URL without re-validation, treating 0.0.0.0 as not internal/special, and bypassing private-address checks after URL canonicalization.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-q87f-qc2r-2gw4
https://github.com/advisories/GHSA-wppf-h75h-6pm6