CVE-2026-46372: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

Synopsis

Server-side request forgery (SSRF) in SillyTavern's SearXNG search proxy. The /api/search/searxng endpoint accepts an attacker-controlled baseUrl and uses it directly for outbound server-side fetches, reachable over the network by any authenticated low-privilege user without victim interaction. Successful exploitation lets an attacker probe internal or loopback HTTP services and read their /search response bodies, exposing internal application data and metadata. A patched-image rebuild at 1.18.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  Attacker must reach the SillyTavern HTTP service over the network (AV:N), typically the locally exposed UI port.

• AuthenticationRequired

  A low-privilege authenticated account on the SillyTavern instance is required (PR:L).

• Victim interactionNot required

  No user action is needed; the attacker calls the /api/search/searxng endpoint directly (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L); the baseUrl parameter is honored without validation, so exploitation is reliable and condition-free.

Blast Radius

• Reads response bodies from internal or loopback HTTP services that the SillyTavern host can reach, including metadata endpoints, admin consoles, and other intranet services.
• Enables internal network reconnaissance by probing arbitrary hosts and ports through the vulnerable proxy.
• Allows limited tampering of search results returned to the SillyTavern UI by pointing baseUrl at attacker-controlled infrastructure (I:L).