SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

NPM: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

NPM: SearXNG MCP Server is Vulnerable to SSRF in weburlread: the internal-address guard is disabled by default MCPHTTPHARDEN off vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...

GHSA-Q87F-QC2R-2GW4 SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...