SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
Date: 2026-06
Affected: npm/mcp-searxng
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: High
CWE: CWE-918
CVSS: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

## DNS-resolved Private Hostname SSRF in `web_url_read` ### Summary The `web_url_read` MCP tool in `mcp-searxng` is vulnerable to Server-Side Request Forgery (SSRF) via DNS rebinding bypass. The `assertUrlAllowed()` function at `src/url-reader.ts:85-93` validates only the syntactic hostname string against a private IP/hostname blocklist without performing DNS resolution. An attacker who controls a domain that resolves to a private or loopback IP address (e.g., via a wildcard DNS service like `nip.io`, or a custom DNS entry) can bypass the security check and cause the MCP server to read arbitrary internal HTTP services reachable from the server host. This allows exfiltration of sensitive data from internal services with no authentication required in the default HTTP configuration. ### Details The vulnerable code is in `src/url-reader.ts`, where the `assertUrlAllowed()` function performs a hostname-only string comparison: ```ts // src/url-reader.ts:85-93 function assertUrlAllowed(url: URL): void { const security = getHttpSecurityConfig(); if (security.allowPrivateUrls) { return; } if (isPrivateHostname(url.hostname) || isPrivateIpv4(url.hostname) || isPrivateIPv6(url.hostname)) { throw createURLSecurityPolicyError(url.toString()); } } ``` This function checks whether `url.hostname` lexically matches a private address pattern but never resolves the hostname via DNS. The OS-level DNS resolution happens later, inside `undiciFetch()` at `src/url-reader.ts:3


Mitigations:

Architectural layers (MAESTRO):