CVE-2026-58485 in mcp-searxng
Summary
by MITRE • 09/15/2026
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed() within src/url-reader.ts before undiciFetch() performs operating-system DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address therefore passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can use this path to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments, prompt-influenced tool selection can provide the malicious URL. Direct private IP literals are blocked, and MCP_HTTP_ALLOW_PRIVATE_URLS remains an explicit opt-out. This issue is fixed in version 1.7.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in mcp-searxng versions prior to 1.7.1 represents a critical server-side request forgery flaw rooted in insufficient URL validation logic within the web_url_read functionality. As a Model Context Protocol server designed to provide AI assistants with web search and URL-reading capabilities, this component processes user-supplied URLs through src/index.ts before passing them to undiciFetch for actual network communication. The core technical failure lies in the assertUrlAllowed function located in src/url-reader.ts, which performs only lexical validation of the hostname rather than resolving it prior to comparison against an allowlist. This architectural oversight allows a public-looking attacker-controlled hostname that resolves via DNS to private, loopback, link-local, or cloud-metadata IP addresses to bypass security checks and successfully initiate connections to internal network resources.
From a technical perspective, this flaw exploits the timing gap between lexical validation and actual DNS resolution. By supplying a domain name that appears legitimate during the initial check but is controlled by an attacker via their own DNS records, it becomes possible to redirect traffic intended for external services toward sensitive internal infrastructure. This mechanism effectively bypasses protections such as direct private IP literals which are explicitly blocked, and circumvents the MCP_HTTP_ALLOW_PRIVATE_URLS configuration flag because the validation occurs against a hostname rather than an resolved IP address. The vulnerability is particularly severe in STDIO deployments where prompt-influenced tool selection can be manipulated by malicious actors to trigger this code path without requiring explicit user interaction beyond providing crafted input.
The operational impact of this vulnerability is significant, enabling unauthenticated network clients to perform internal service enumeration and data exfiltration. Attackers can leverage this flaw to read responses from internal services that are not exposed to the public internet, potentially exposing sensitive credentials, service tokens, or proprietary configuration details stored in headers or response bodies. Furthermore, by systematically varying hostnames and analyzing differences in server responses such as HTTP status codes or timing variations, an attacker can map out the internal network topology and identify reachable hosts within private address spaces. This capability transforms a simple URL reading feature into a powerful reconnaissance tool for lateral movement and further exploitation of adjacent systems.
This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) as it allows an attacker to induce the server-side application to make requests to arbitrary destinations, specifically targeting internal resources that should be inaccessible from untrusted contexts. It also maps directly to MITRE ATT&CK technique T1557 Adversary-in-the-Middle when used in conjunction with other attacks, or more accurately T1046 Network Service Discovery for the enumeration aspect and T1078 Valid Accounts if credentials are harvested. The lack of early DNS resolution during validation is a common pattern in SSRF vulnerabilities where developers assume that checking against an allowlist of hostnames provides sufficient security without considering DNS rebinding or controlled domain resolution techniques.
To mitigate this vulnerability, organizations must upgrade to version 1.7.1 which addresses the flawed validation logic by ensuring proper DNS resolution occurs before allowing connections to proceed. In environments where upgrading is not immediately feasible, implementing a network-level proxy that inspects outbound traffic from the mcp-searxng container or process can provide an additional layer of defense by blocking requests destined for private IP ranges regardless of how they were initiated. Additionally, restricting the MCP server's network access using firewall rules to only permit connections to explicitly whitelisted external domains and IPs is recommended. For STDIO deployments, strict input sanitization at the application level that prevents prompt injection from influencing tool selection parameters can reduce the attack surface available to malicious actors attempting to exploit this code path through AI assistant interactions.