GHSA-mrvx-jmjw-vggc: SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
- Identifier
- GHSA-mrvx-jmjw-vggc
- Published
- Record updated
- Affected
- mcp-searxng < 1.7.1
- Fixed in
- 1.7.1
- released June 18, 2026, 1 day before disclosure
Summary
The `web_url_read` tool in `mcp-searxng` is vulnerable to SSRF via DNS rebinding. The `assertUrlAllowed()` function in `src/url-reader.ts` checks only the hostname string against a private address blocklist and performs no DNS resolution, so a domain that resolves to a private or loopback IP bypasses the check. In default HTTP mode, where `requireAuth` is `false`, an attacker can read arbitrary internal HTTP services reachable from the server host without authentication.
Mitigation
The source recommends resolving the hostname with `node:dns/promises` inside `assertUrlAllowed()` before the fetch is issued, rejecting non-http(s) protocols, and checking the resolved addresses against the private IPv4 and IPv6 checks, with `assertUrlAllowed()` made async and awaited at both call sites.
Topics
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online