CVE-2026-58485: mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed() within src/url-reader.ts before undiciFetch() performs operating-system DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address therefore passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can use this path to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments, prompt-influenced tool selection can provide the malicious URL. Direct private IP literals are blocked, and MCPHTTPALLOWPRIVATEURLS remains an explicit opt-out. This issue is fixed in version 1.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mcp-searxngto a version that resolves this vulnerability.Fixed in 1.7.1
Event History
Frequently Asked Questions
Which deployments are most exposed?
Default HTTP deployments are most exposed because an unauthenticated network client can supply a URL to web_url_read. STDIO deployments can also be affected when prompt-influenced tool selection causes a malicious URL to be used.
What must an attacker provide to bypass the URL restriction?
The attacker needs a public-looking hostname they control that resolves through DNS to a private, loopback, link-local, or cloud-metadata address. Direct private IP address literals are blocked.
Are default settings affected?
Yes. The default HTTP configuration is affected, and an unauthenticated network client can use the issue to access reachable internal services, enumerate hosts, or expose credentials and service tokens.
What can be done before upgrading?
Do not enable MCP_HTTP_ALLOW_PRIVATE_URLS, as it is an explicit opt-out from the private-URL restriction. Limit untrusted network access to HTTP deployments and prevent untrusted callers or prompts from controlling URLs passed to web_url_read.
How can I determine whether an instance is vulnerable?
Instances running a version prior to 1.7.1 are affected if web_url_read can be given a hostname that appears public but resolves to an internal address. Version 1.7.1 contains the fix.