CVE-2026-58485: 
JavaScript vulnerability analysis and mitigation

CVE-2026-58485 is a Server-Side Request Forgery (SSRF) vulnerability via DNS rebinding bypass in the web_url_read MCP tool of the mcp-searxng npm package. The flaw allows an attacker to bypass the private IP/hostname blocklist by supplying a domain that syntactically appears public but resolves to a private or loopback address at fetch time. All versions up to and including 1.6.0 are affected; version 1.7.1 contains the fix. It was published on June 18, 2026, and carries a CVSS v3.1 score of 7.1 (High) (GitHub Advisory, GHSA).

The root cause (CWE-918) lies in the assertUrlAllowed() function in src/url-reader.ts (lines 85–93), which performs only a lexical string comparison of url.hostname against known private IP/hostname patterns — no DNS resolution is performed at this stage. OS-level DNS resolution occurs later inside undiciFetch() at line 367, after the security gate has already passed, creating a time-of-check/time-of-use gap. An attacker can exploit this by providing a URL whose hostname passes the string check (e.g., http://ssrf-target.internal:PORT/ or http://127.0.0.1.nip.io:PORT/) but resolves to a private or loopback address at fetch time. In the default HTTP deployment (MCP_HTTP_HARDEN unset), requireAuth is false, meaning no credentials are needed to invoke the tool; in STDIO mode, exploitation requires influencing the connected AI agent via prompt injection or malicious web content (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker (in default HTTP mode) to read arbitrary internal HTTP services reachable from the MCP server host, including cloud metadata endpoints (e.g., 169.254.169.254), internal APIs, admin dashboards, and databases with HTTP interfaces. Sensitive data such as cloud provider credentials, internal service tokens, and configuration secrets can be exfiltrated. The vulnerability also enables internal network topology enumeration by probing responses from different internal hosts and ports, with no impact on integrity or availability but a high confidentiality impact with scope change (GitHub Advisory).

A public proof-of-concept (PoC) is included in the security advisory, consisting of a Dockerfile and Python script that demonstrate the bypass using Docker's --add-host flag to simulate a DNS-resolved private hostname. No evidence of in-the-wild exploitation or threat actor attribution is currently available. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score has been published at this time. The attack requires no privileges and no user interaction in the default HTTP configuration, lowering the bar for exploitation significantly (GitHub Advisory, GHSA).

1. Identify target: Locate an exposed mcp-searxng instance running version ≤ 1.6.0, ideally in the default HTTP mode where MCP_HTTP_HARDEN is unset and authentication is disabled.
2. Prepare bypass domain: Register or use a public wildcard DNS service (e.g., nip.io) to create a hostname that resolves to a private/loopback IP — for example, http://127.0.0.1.nip.io:PORT/ or a custom DNS record pointing to 169.254.169.254.
3. Craft MCP JSON-RPC request: Construct a tools/call request targeting web_url_read with the bypass URL:

{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"web_url_read","arguments":{"url":"http://127.0.0.1.nip.io:PORT/","maxLength":200}}}

4. Bypass security check: The assertUrlAllowed() function evaluates the hostname string 127.0.0.1.nip.io — which does not match private IP patterns — and allows the request to proceed.
5. DNS resolution at fetch time: undiciFetch() resolves the hostname via OS DNS, obtaining the private IP (e.g., 127.0.0.1 or 169.254.169.254), and connects to the internal service.
6. Exfiltrate data: The MCP server returns the response body from the internal service (e.g., cloud metadata credentials, internal API responses) in the tool's result content field (GitHub Advisory).

• Network: Outbound HTTP requests from the MCP server host to internal RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), or cloud metadata endpoints (169.254.169.254); DNS queries for hostnames using wildcard services like nip.io or sslip.io that resolve to private IPs.
• Logs: MCP server access logs showing tools/call requests for web_url_read with hostnames that are syntactically public but resolve to private addresses; repeated requests to the same internal port from the MCP process.
• Process: Unexpected outbound TCP connections initiated by the Node.js MCP server process to internal network addresses or loopback ports not associated with normal operation.
• File System: No specific file artifacts expected, but review for any exfiltrated credential files or configuration dumps written to disk by downstream processes (GitHub Advisory).

Upgrade mcp-searxng to version 1.7.1 or later, which resolves the hostname via node:dns/promises inside assertUrlAllowed() before the fetch is issued, blocking DNS-rebinding bypass attempts. As a temporary workaround for users unable to upgrade immediately, set MCP_HTTP_HARDEN=true to enable authentication requirements, and avoid setting MCP_HTTP_ALLOW_PRIVATE_URLS=true. Additionally, network-level controls (e.g., egress firewall rules blocking the MCP server from reaching internal RFC-1918 ranges and cloud metadata endpoints) can reduce the blast radius (GitHub Advisory).

The vulnerability was reported by EQSTLab (reporter) and analyzed by useworld (analyst), and was published by the repository maintainer ihor-sokoliuk on June 18, 2026. No broader media coverage, vendor statements beyond the advisory, or notable social media commentary has been identified at this time (GitHub Advisory).