GHSA-HJWH-XVFW-QRWJ: Credential Disclosure via Diagnostic Boundaries in mcp-searxng

The mcp-searxng package is an implementation of the Model Context Protocol (MCP) designed to expose SearXNG private search capabilities to artificial intelligence assistants. In typical deployments, the server connects to a private SearXNG instance using credentials provided through the SEARXNG_URL environment variable. This configuration contains Basic Authentication credentials in plain-text format, which are parsed dynamically during system operations.

The application exposes a significant attack surface by failing to isolate diagnostic data across systemic boundaries. When errors or normal startup routines execute, the component forwards configuration parameters to stdout, stderr, and network communication channels. This behavior allows anyone with read permission on system streams or access to the MCP protocol messages to acquire active system credentials.

The core vulnerability belongs to the CWE-209 (Generation of Error Message Containing Sensitive Information) and CWE-532 (Insertion of Sensitive Information into Log File) classes. Exploitation allows local actors or connected remote clients to obtain full read-access to the underlying SearXNG search database by extracting administrative credentials. The lack of structured redaction guarantees that any diagnostic exception results in the immediate exposure of raw credentials.

The underlying flaw is located within the startup, logging, and exception aggregation mechanisms of mcp-searxng versions prior to 1.12.0. While a redaction utility named redactSearxngInstanceUrl() existed in src/searxng-instances.ts, the application failed to invoke this function systematically across diagnostic boundaries. This omission created multiple vectors where sensitive environment configurations containing raw authentication tokens bypassed protection layers.

The first vector occurs during initialization in src/index.ts where the system logs active search endpoints. The code queries getSearxngInstances() and directly maps the output arrays to a formatted string written to console.error. Because the URLs are output without sanitization, any administrative username and password values defined within the URI userinfo block are exposed in plain text within system logs.

The second vector involves protocol-level notification logging using the logMessage() helper inside src/index.ts. Once an MCP client completes the handshake, the server sends JSON-RPC telemetry notification messages containing the raw SEARXNG_URL value. Any authenticated client, regardless of administrative level, receives these messages automatically. Additionally, validation routines in src/searxng-instances.ts capture URL formatting exceptions and append the raw invalid value into the thrown error string, which is then serialized directly into JSON-RPC error responses.

In vulnerable versions, the startup configuration is output to standard error streams using direct variable interpolation. The following code fragment from src/index.ts illustrates the unredacted logging path:

// Vulnerable startup initialization logs raw array contents to console.error
const searxngInstances = getSearxngInstances();
if (searxngInstances.length > 0) {
  console.error(`🌐 SearXNG URLs: ${searxngInstances.join("; ")}`);
}

This routine does not call any sanitization layers, ensuring that any user credentials stored inside the URI string are printed to the runtime logs.

The patched version resolves this exposure by implementing a centralized diagnostic sanitizer. In src/diagnostic-sanitizer.ts, the application implements sanitizeDiagnosticText() and sanitizeDiagnosticValue() to filter outbound data. During initialization, the application captures a snapshot of configured credentials and processes multiple potential representations, including percent-encoded, Base64-encoded, and plain-text forms.

// Patched startup logs utilize sanitizeDiagnosticText for boundary protection
const searxngInstances = getSearxngInstances();
if (searxngInstances.length > 0) {
  console.error(sanitizeDiagnosticText(`🌐 SearXNG URLs: ${searxngInstances.join("; ")}`));
}

The implementation uses regular expressions to strip the username and password authority parameters from HTTP and HTTPS URLs, replacing them with generic redacted values.

Evaluating the effectiveness of this patch shows a complete architecture change for diagnostic management. The sanitizer dynamically hooks error generation, ensuring that thrown objects run through sanitizeErrorForTransport() before being serialized into JSON-RPC payloads. The inclusion of complex encoding conversions (such as Base64 representation of username:password strings) prevents bypasses where credentials leak via HTTP Authorization header equivalents in raw debugging traces. The mitigation is complete because it controls all egress paths.

Exploitation of this vulnerability requires either local access to standard diagnostic streams or an active client connection to the MCP server. An attacker seeking to extract credentials locally must read the standard error (stderr) stream output by the Node.js process. In automated environments, this is achieved by reading container logs or inspecting shared journal files.

Alternatively, a client connected to the MCP daemon can retrieve credentials remotely by interacting with the JSON-RPC interface. Upon sending a standard initialize request, the server returns configuration details via automatic notifications/message payloads. Triggering validation rules is also effective; sending queries that violate target schemes forces the internal parser to throw validation errors that return the complete string containing the credentials.

The flow of the credential leak is illustrated below. The raw environment variables transit through the insecure logging boundary and validation wrappers, generating unredacted diagnostics:

The impact of this disclosure is high confidentiality loss for the associated SearXNG instance. Because SearXNG servers can be configured to protect sensitive indexes or private lookup endpoints, compromising these credentials allows attackers to execute searches, harvest information, and consume resources of the downstream target. The exposed credentials can also be reused if the target utilizes identical Basic Authentication tokens across other infrastructure nodes.

The CVSS v3.1 score is evaluated at 5.5, indicating Medium severity. The local attack vector metric (AV:L) reflects the standard deployment model where MCP servers communicate over standard input/output transport layers bound to the parent process. If the MCP server is configured to run over network transports (such as WebSockets or remote HTTP bridges), the exploitation vector expands to network-accessible scopes.

No active exploitation in the wild has been observed or reported in threat databases, and the issue is not listed in the CISA KEV catalog. However, the availability of public proof-of-concept steps increases the likelihood of opportunistic exploitation in misconfigured shared host environments or automated log collection servers.

Remediation of this vulnerability requires immediate migration to mcp-searxng version 1.12.0 or higher. The upgraded package introduces the robust diagnostic sanitizer, which automatically redacts credentials from both stdout/stderr logs and outgoing JSON-RPC error frames. To apply the patch, execute npm install mcp-searxng@latest within the application environment.

In addition to upgrading the package, administrators must rotate the Basic Authentication credentials of the configured SearXNG search servers. Since older versions of the software wrote to standard logs, historical database indices and system aggregation streams may contain cached plaintext credentials. These files must be sanitized or purged to prevent backward-looking credential harvesting.

For downstream developers, configurations inside .mcp/server.json should be verified. The parameter SEARXNG_URL must have its isSecret property set to true to ensure MCP clients mask values in administrative portals. Applying these configurations blocks UI-level disclosure and enforces end-to-end credential containment.