THREAT OPS › Threat News › [GHSA] GHSA-wppf-h75h-6pm6 (medium) — SearXNG MCP Server: Additional hardened-mode SSRF bypasses
[GHSA] GHSA-wppf-h75h-6pm6 (medium) — SearXNG MCP Server: Additional hardened-mode SSRF bypasses
GHSA-wppf-h75h-6pm6 Severity: medium CVE: CVE-2026-54689
SearXNG MCP Server: Additional hardened-mode SSRF bypasses
## Summary
`mcp-searxng` has a hardened-mode URL-reading feature intended to prevent `web_url_read` from reaching private or internal network resources.
PR #79 appears to address one SSRF class: hostnames that resolve to private or internal addresses under hardened mode. I tested
Indicators of compromise
- e55d28e7be6786a71cd7a0eaf13d3ec9d0b734d4sha1
- CVE-2026-54689cve
- http://127.0.0.1:6789/secreturl
- http://0.0.0.0:6789/secreturl
- http://0.0.0.0:6789/secret|http://url
- http://198.51.100.1:6790/jumpurl
- http://0.0.0.0:6789/secret|http://198.51.100.1:6790/jump|url
- 198.51.100.1ipv4
- 198.51.100.1/32cidr
- 0.0.0.0/8cidr
Original source: https://github.com/advisories/GHSA-wppf-h75h-6pm6