CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
An attacker can force the server to fetch internal resources by supplying a malicious URL, exposing sensitive data to the AI model context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54688?
CVE-2026-54688 is a medium-severity server-side request forgery vulnerability in ihor-sokoliuk mcp-searxng, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, even though MCP_HTTP_HARDEN is disabled by default in src/http-security.ts. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context. file:// URLs remain rejected, and the separate DNS-resolution and redirect-validation bypasses are outside this record. This issue is fixed in version 1.2.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-54688?
2 open source packages ship an affected version, including mcp-searxng.
| Package | Affected | Fixed in |
|---|---|---|
mcp-searxng npm | All versions | 1.2.1 |
mcp-searxng npm | All versions | 1.2.1 |
How do I fix CVE-2026-54688?
Upgrade mcp-searxng to 1.2.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54688 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54688 exists.
Sources
Also known as GHSA-q87f-qc2r-2gw4.