GHSA-q87f-qc2r-2gw4Published
mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54688 · Microsoft / collected KEV context
cve-program · CVE-2026-54688
- https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-q87f-qc2r-2gw4
- https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694
- https://github.com/ihor-sokoliuk/mcp-searxng/commit/48e5ecdcb4166a60b94c252dbe74b0a318110ac4
- https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.0
euvd · EUVD-2026-78923
- https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-q87f-qc2r-2gw4
- https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694
- https://github.com/ihor-sokoliuk/mcp-searxng/commit/48e5ecdcb4166a60b94c252dbe74b0a318110ac4
- https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.0
nvd · CVE-2026-54688
- https://github.com/ihor-sokoliuk/mcp-searxng/commit/48e5ecdcb4166a60b94c252dbe74b0a318110ac4
- https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694
- https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.0
- https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-q87f-qc2r-2gw4
osv · GHSA-q87f-qc2r-2gw4
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.