GHSA-hjwh-xvfw-qrwj SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Not scored Published 19 Aug 2026

An attacker with log access or MCP client connectivity can recover SearXNG Basic Authentication credentials exposed in logs and error responses.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is GHSA-hjwh-xvfw-qrwj?

GHSA-hjwh-xvfw-qrwj is a vulnerability in mcp-searxng, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Summary

mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNG_URL environment variable.

When the server starts in STDIO mode and an MCP client connects, the complete SEARXNG_URL, including its username and password, is sent to the client through an MCP notifications/message logging notification.

Additionally, when URL validation fails, the complete credential-bearing URL is included in the configuration error. This error is logged through MCP and returned to the client as a JSON-RPC error response.

For example, a value such as:

http://username:[email protected]

is exposed without redaction.

A connected MCP client or anyone with access to captured server logs may recover the SearXNG credentials and use them to access the configured SearXNG instance.

The issue was confirmed in:

mcp-searxng 1.11.0

Suggested severity: Medium

Details

mcp-searxng supports SearXNG Basic Authentication by embedding credentials in the URL userinfo component:

https://username:[email protected]

The project contains a redaction function named redactSearxngInstanceUrl(), but it is not used in several logging and error-handling paths.

Startup console disclosure

In src/index.ts:373-378, the server retrieves the raw SearXNG URLs and writes them directly to stderr:

const searxngInstances = getSearxngInstances();

if (searxngInstances.length &gt; 0) {
  console.error(`🌐 SearXNG URLs: ${searxngInstances.join(&#34;; &#34;)}`);
}

getSearxngInstances() returns the unmodified environment-variable values.

Relevant code in src/searxng-instances.ts:25-38:

export function parseSearxngUrls(
  raw: string | undefined = process.env.SEARXNG_URL
): string[] {
  if (raw === undefined) {
    return [];
  }

  return raw
    .split(&#34;;&#34;)
    .map((entry) =&gt; entry.trim())
    .filter((entry) =&gt; entry !== &#34;&#34;);
}

export function getSearxngInstances(): string[] {
  return parseSearxngUrls();
}

MCP logging notification disclosure

After the MCP client connects, src/index.ts:388-393 sends the complete URL through the MCP logging interface:

const searxngInstances = getSearxngInstances();

logMessage(
  mcpServer,
  &#34;info&#34;,
  `SearXNG URLs: ${
    searxngInstances.length &gt; 0
      ? searxngInstances.join(&#34;; &#34;)
      : &#34;not configured&#34;
  }`
);

logMessage() passes this value to sendLoggingMessage() in src/logging.ts:15-25:

mcpServer.sendLoggingMessage({
  level,
  data: notificationData
});

As a result, the connected MCP client receives a message containing the username and password:

{
  &#34;method&#34;: &#34;notifications/message&#34;,
  &#34;params&#34;: {
    &#34;level&#34;: &#34;info&#34;,
    &#34;data&#34;: {
      &#34;message&#34;: &#34;SearXNG URLs: http://username:[email protected]&#34;
    }
  },
  &#34;jsonrpc&#34;: &#34;2.0&#34;
}

Configuration error disclosure

The URL validation function includes the complete unredacted value in error messages.

Relevant code in src/searxng-instances.ts:44-52:

export function validateSearxngInstanceUrl(
  value: string
): string | null {
  try {
    const url = new URL(value);

    if (![&#34;http:&#34;, &#34;https:&#34;].includes(url.protocol)) {
      return `SEARXNG_URL invalid protocol for &#34;${value}&#34;: ${url.protocol}`;
    }
  } catch {
    return `SEARXNG_URL invalid format: ${value}`;
  }

  return null;
}

The validation error is aggregated by validateEnvironment() in src/error-handler.ts:175-203:

const validationError =
  validateSearxngInstanceUrl(searxngUrl);

if (validationError) {
  issues.push(validationError);
}

The complete error is then thrown from src/search.ts:689-693:

const validationError = validateEnvironment();

if (validationError) {
  logMessage(mcpServer, &#34;error&#34;, &#34;Configuration invalid&#34;);
  throw new MCPSearXNGError(validationError);
}

The tool handler in src/index.ts:254-260 sends the error message and stack trace through MCP logging, then rethrows it:

logMessage(
  mcpServer,
  &#34;error&#34;,
  `Tool execution error: ${
    error instanceof Error
      ? error.message
      : String(error)
  }`,
  {
    tool: name,
    args: args,
    error:
      error instanceof Error
        ? error.stack
        : String(error)
  }
);

throw error;

Rethrowing the error causes the same unredacted credential-bearing URL to be returned in the JSON-RPC error response.

Existing redaction function is not used

The project already contains a suitable redaction function in src/searxng-instances.ts:57-69:

export function redactSearxngInstanceUrl(
  raw: string
): string {
  try {
    const url = new URL(raw);

    if (!url.username &amp;&amp; !url.password) {
      return raw;
    }

    url.username = &#34;&#34;;
    url.password = &#34;&#34;;
    return url.toString();
  } catch {
    return raw.replace(
      /^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/]*@/,
      &#34;$1&#34;
    );
  }
}

However, this function is not applied before startup logging, MCP logging, or configuration error construction.

The MCP manifest also marks SEARXNG_URL as non-secret in .mcp/server.json:20-25:

{
  &#34;name&#34;: &#34;SEARXNG_URL&#34;,
  &#34;description&#34;: &#34;URL of your SearXNG instance&#34;,
  &#34;isRequired&#34;: true,
  &#34;isSecret&#34;: false,
  &#34;format&#34;: &#34;string&#34;
}

Because credentials may be embedded in this variable, it should be classified as a secret.

PoC

The following proof of concept uses fake credentials. A real SearXNG server is not required.

Requirements

Node.js 20 or newer
npm
mcp-searxng 1.11.0 source code

Build the application

unzip mcp-searxng-main.zip
cd mcp-searxng-main

npm ci
npm run build

Test 1: Credential disclosure through MCP logging

Create an MCP initialization request:

cat &gt; /tmp/mcp-init.jsonl &lt;&lt;&#39;EOF&#39;
{&#34;jsonrpc&#34;:&#34;2.0&#34;,&#34;id&#34;:1,&#34;method&#34;:&#34;initialize&#34;,&#34;params&#34;:{&#34;protocolVersion&#34;:&#34;2024-11-05&#34;,&#34;capabilities&#34;:{},&#34;clientInfo&#34;:{&#34;name&#34;:&#34;credential-leak-poc&#34;,&#34;version&#34;:&#34;1.0.0&#34;}}}
EOF

Start the server with fake credentials embedded in a valid HTTP URL:

SEARXNG_URL=&#39;http://MCP_POC_USER_7391:[email protected]:9&#39; \
timeout 8s node dist/cli.js \
&lt; /tmp/mcp-init.jsonl \
2&gt;&amp;1 | tee credential-log-leak.txt

Search the output for the credentials:

grep -nE \
&#39;MCP_POC_USER_7391|MCP_POC_PASS_7391&#39; \
credential-log-leak.txt

Observed result

The complete credential-bearing URL is exposed:

SearXNG URLs: http://MCP_POC_USER_7391:[email protected]:9

It is also delivered to the MCP client:

{
  &#34;method&#34;: &#34;notifications/message&#34;,
  &#34;params&#34;: {
    &#34;level&#34;: &#34;info&#34;,
    &#34;data&#34;: {
      &#34;message&#34;: &#34;SearXNG URLs: http://MCP_POC_USER_7391:[email protected]:9&#34;
    }
  },
  &#34;jsonrpc&#34;: &#34;2.0&#34;
}

This confirms that a connected MCP client can recover the configured username and password without accessing the host environment.

Test 2: Credential disclosure through JSON-RPC errors

Create initialization and tool-call requests:

cat &gt; /tmp/mcp-error-poc.jsonl &lt;&lt;&#39;EOF&#39;
{&#34;jsonrpc&#34;:&#34;2.0&#34;,&#34;id&#34;:1,&#34;method&#34;:&#34;initialize&#34;,&#34;params&#34;:{&#34;protocolVersion&#34;:&#34;2024-11-05&#34;,&#34;capabilities&#34;:{},&#34;clientInfo&#34;:{&#34;name&#34;:&#34;credential-error-poc&#34;,&#34;version&#34;:&#34;1.0.0&#34;}}}
{&#34;jsonrpc&#34;:&#34;2.0&#34;,&#34;id&#34;:2,&#34;method&#34;:&#34;tools/call&#34;,&#34;params&#34;:{&#34;name&#34;:&#34;searxng_web_search&#34;,&#34;arguments&#34;:{&#34;query&#34;:&#34;credential leak test&#34;}}}
EOF

Start the server with a credential-bearing URL that uses an unsupported protocol:

SEARXNG_URL=&#39;ftp://MCP_POC_USER_7391:[email protected]&#39; \
timeout 8s node dist/cli.js \
&lt; /tmp/mcp-error-poc.jsonl \
2&gt;&amp;1 | tee credential-error-leak.txt

Search the response:

grep -nE \
&#39;MCP_POC_USER_7391|MCP_POC_PASS_7391&#39; \
credential-error-leak.txt

Observed result

The complete URL is exposed in the MCP logging notification:

Tool execution error: Configuration Issues: SEARXNG_URL invalid protocol

Which versions are affected by GHSA-hjwh-xvfw-qrwj?

2 open source packages ship an affected version, including mcp-searxng.

Package	Affected	Fixed in
`mcp-searxng` npm	All versions	`1.12.0`
`mcp-searxng` npm	All versions	`1.12.0`

How do I fix GHSA-hjwh-xvfw-qrwj?

Upgrade mcp-searxng to 1.12.0 or later.

Is GHSA-hjwh-xvfw-qrwj being exploited?

There is no known exploitation of GHSA-hjwh-xvfw-qrwj in the wild and no public exploit code.

GHSA-hjwh-xvfw-qrwj SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

What is GHSA-hjwh-xvfw-qrwj?

Summary

Details

Startup console disclosure

MCP logging notification disclosure

Configuration error disclosure

Existing redaction function is not used

PoC

Requirements

Build the application

Test 1: Credential disclosure through MCP logging

Observed result

Test 2: Credential disclosure through JSON-RPC errors

Observed result

Which versions are affected by GHSA-hjwh-xvfw-qrwj?

How do I fix GHSA-hjwh-xvfw-qrwj?

Is GHSA-hjwh-xvfw-qrwj being exploited?

Sources

Is GHSA-hjwh-xvfw-qrwj in your software?