CVE-2026-58485

mcp-searxng, a Model Context Protocol (MCP) server that gives AI assistants web search and URL-reading capabilities via SearXNG, is vulnerable to server-side request forgery (SSRF) in all versions prior to 1.7.1. The web_url_read tool validates only the literal hostname in assertUrlAllowed() before undiciFetch() performs DNS resolution, so an attacker-controlled public-looking hostname that actually resolves to a private, loopback, link-local, or cloud-metadata address passes the check and the server connects to the internal destination. In default HTTP configurations an unauthenticated network client can exploit this to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments a prompt-injected tool call can supply the malicious URL. Direct private IP literals are blocked and MCP_HTTP_ALLOW_PRIVATE_URLS remains an explicit opt-out, but rebinding-style hostnames are not caught before the fix. The issue is patched in version 1.7.1 and no public PoC or in-the-wild exploitation is known.

What to do: Upgrade mcp-searxng to version 1.7.1 or later. Review logs of web_url_read calls for public hostnames that resolved to internal/private ranges, and treat any credentials or tokens reachable from the server as potentially exposed. Do not enable MCP_HTTP_ALLOW_PRIVATE_URLS, restrict network access to HTTP-mode instances, and be wary of URLs supplied through prompts in STDIO deployments.