CVE-2026-45019
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Chainlit versions from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, expose the POST /mcp endpoint without authentication. An attacker can control the URL and headers, allowing blind outbound requests to internal or external services, including cloud metadata endpoints, with arbitrary Authorization and Cookie headers. This issue is fixed in version 2.12.0.
Risk Assessment
The risk includes unauthorized access to internal resources, port scanning, service discovery, and the ability to issue state-changing requests, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately upgrade Chainlit to version 2.12.0 or later, and if possible, disable the MCP feature or restrict access to the /mcp endpoint.
Other vulnerabilities in Chainlit
See all- CVE-2026-45018Critical
Chainlit from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, exposes the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string, and validation only checks the executable name, allowing arbitrary command execution via the -c argument in npx.
- CVE-2026-22219High
An SSRF vulnerability in Chainlit before version 2.9.4 allows an authenticated attacker to make arbitrary HTTP requests from the server to internal network services or cloud metadata endpoints via a user-controlled URL in an Element during the /project/element update flow with the SQLAlchemy data layer backend.
- CVE-2026-22218Medium
A vulnerability in Chainlit versions prior to 2.9.4 allows an authenticated attacker to read arbitrary files on the server by manipulating the path in a project element update request. The attacker can copy the file to their session and then retrieve it using the element identifier.
- CVE-2026-82290Medium
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
- CVE-2026-56104High
Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Original NVD description (English source)
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect_mcp handler in backend/chainlit/server.py passes these values to sse_client() or streamablehttp_client(), allowing the Chainlit server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers. The SSE URL sink has existed since 2.4.0rc0, while attacker-controlled header forwarding and streamable-http support were added in 2.6.4. The response is consumed internally and not returned, but the attacker can issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints. This issue is fixed in version 2.12.0.