CVE-2026-45019
Received Received - Intake

Server-Side Request Forgery in Chainlit Framework

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect_mcp handler in backend/chainlit/server.py passes these values to sse_client() or streamablehttp_client(), allowing the Chainlit server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers. The SSE URL sink has existed since 2.4.0rc0, while attacker-controlled header forwarding and streamable-http support were added in 2.6.4. The response is consumed internally and not returned, but the attacker can issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints. This issue is fixed in version 2.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-45019
EUVD
EUVD-2026-65738

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
chainlit chainlit From 2.4.0rc0 (inc) to 2.11.x (inc)
chainlit chainlit to 2.12.0 (inc)
chainlit chainlit 2.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Chainlit versions 2.4.0rc0 to 2.12.0 have an authentication bypass vulnerability when the MCP feature is enabled. The POST /mcp endpoint allows unauthenticated access, and user-controlled URLs and headers can be passed without validation. This enables blind outbound requests to internal or external services, including cloud metadata endpoints, with attacker-controlled headers.

Detection Guidance

To detect this vulnerability, check if your Chainlit deployment has features.mcp.enabled set to true in .chainlit/config.toml. Verify if the POST /mcp endpoint is exposed without authentication. Monitor network traffic for outbound requests to internal or external services with attacker-controlled headers.

Impact Analysis

An attacker could exploit this to make unauthorized requests from your Chainlit server, potentially accessing internal services, scanning ports, probing metadata endpoints, or issuing authenticated state-changing requests. This could lead to data exfiltration, service disruption, or further network compromise.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. GDPR may be breached if personal data is exposed, while HIPAA could be violated if protected health information is accessible. Organizations must ensure proper access controls to maintain regulatory compliance.

Mitigation Strategies

Upgrade Chainlit to version 2.12.0 or later to fix the vulnerability. If upgrading is not immediately possible, disable the MCP feature by setting features.mcp.enabled to false in .chainlit/config.toml. Ensure the POST /mcp endpoint is not exposed without authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart