CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access
An attacker can bypass SSRF protections in mcp-searxng to access internal network resources and cloud metadata endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54689?
CVE-2026-54689 is a medium-severity server-side request forgery vulnerability in ihor-sokoliuk mcp-searxng, published on 15 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
Which versions are affected by CVE-2026-54689?
2 open source packages ship an affected version, including mcp-searxng.
| Package | Affected | Fixed in |
|---|---|---|
mcp-searxng npm | All versions | 1.2.1 |
mcp-searxng npm | All versions | 1.2.1 |
How do I fix CVE-2026-54689?
Upgrade mcp-searxng to 1.2.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54689 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54689 exists.
Sources
Also known as GHSA-wppf-h75h-6pm6.