AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-q87f-qc2r-2gw4: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mediumvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseAugust 19, 2026CVE-2026-54688

Summary

SearXNG MCP Server has an SSRF vulnerability (server-side request forgery, where a server is tricked into fetching URLs chosen by an attacker) in its web_url_read tool because the internal-address guard is disabled by default. An attacker who can control the URL input (for example, through prompt injection, where hidden instructions in AI input trick the model into producing malicious content) can make the server fetch private internal services or cloud metadata and return their contents, but this only happens when the MCP_HTTP_HARDEN setting is off by default.

Solution / Mitigation

The source text describes the desired remediation but does not provide a concrete patch or version fix. The recommended approach stated is: 'Enable the internal-address filtering by default (fail safe): make assertUrlAllowed run unconditionally and require an explicit opt-out only for trusted environments. Strengthen the check to resolve the host and reject loopback, link-local/metadata (169.254.0.0/16), 0.0.0.0/8, and private ranges, and re-validate on every redirect hop (or pin to the validated IP).' No patched version is mentioned in the source.