Three advisories published for the SearXNG MCP server, including basic-auth credentials leaking through MCP logs and JSON-RPC errors

Three advisories were published for mcp-searxng inside ten minutes on the evening of 2026-08-19. All three are rated medium. Two carry CVE identifiers and describe server-side request forgery; the third has no CVE and describes the protocol-specific problem of the set.

That third record, GHSA-hjwh-xvfw-qrwj at CVSS 5.5, states that the SearXNG instance's Basic Authentication credentials were exposed through MCP logs and JSON-RPC error responses. Both are channels a server is supposed to be able to emit freely: logs go wherever the host collects them, and a JSON-RPC error travels straight back to the client and, in practice, into a model's context. Credentials configured for an upstream service reaching either one is a disclosure that no amount of care at the tool boundary prevents. It was fixed in 1.12.0, published 2026-07-26.

The two SSRF records concern the web_url_read tool. CVE-2026-54688 records that the guard against internal addresses was disabled by default, gated behind an MCP_HTTP_HARDEN setting that was off unless a deployment turned it on. CVE-2026-54689 records further ways to bypass the guard even when hardened mode was enabled. Both were fixed in 1.2.1.

The dates matter for anyone reading the three together as a single event. Version 1.2.1 was published on 2026-06-07, roughly two hours after 1.2.0, which puts the two SSRF fixes ten weeks before the advisories that describe them. The credential fix in 1.12.0 is three and a half weeks old by the same measure. The current release is 1.16.0, published 2026-08-20. The package recorded 87,552 downloads in the last month.