ihor-sokoliuk/mcp-searxng Security Advisories | GitStock

medium2026-08-19

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

GHSA-hjwh-xvfw-qrwj

medium2026-08-19

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

GHSA-wppf-h75h-6pm6 · CVE-2026-54689

medium2026-08-19

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

GHSA-q87f-qc2r-2gw4 · CVE-2026-54688

high2026-06-19

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

GHSA-mrvx-jmjw-vggc

high2026-06-19

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

GHSA-xcqx-9jf5-w339