CVE-2026-45019 in Chainlit
Summary
by MITRE • 08/25/2026
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect_mcp handler in backend/chainlit/server.py passes these values to sse_client() or streamablehttp_client(), allowing the Chainlit server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers. The SSE URL sink has existed since 2.4.0rc0, while attacker-controlled header forwarding and streamable-http support were added in 2.6.4. The response is consumed internally and not returned, but the attacker can issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints. This issue is fixed in version 2.12.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
Chainlit is a Python framework designed for building production-ready conversational AI applications that integrate with various large language models and external tools. A critical security vulnerability was identified within versions ranging from 2.4.0rc0 to 2.12.0, specifically affecting deployments where the features.mcp.enabled configuration option is set to true in the .chainlit/config.toml file. This misconfiguration exposes the POST /mcp endpoint without requiring any form of authentication, creating a significant attack surface for unauthorized actors who can interact with the server's internal mechanisms directly through this unauthenticated interface.
The core technical flaw lies in how the framework handles requests for Model Context Protocol (MCP) connections using Server-Sent Events and streamable HTTP transports. The ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest classes, defined in backend/chainlit/types.py, accept a user-controlled URL along with an optional headers dictionary. Crucially, the implementation lacks any scheme validation to restrict protocols such as file or gopher, fails to implement private-address filtering to block requests targeting internal network ranges, and does not enforce an allowlist of permitted destinations. This absence of input sanitization allows attackers to specify arbitrary endpoints for the server to connect to on their behalf.
When a request is received by the connect_mcp handler in backend/chainlit/server.py, it passes these unsanitized values directly into internal client functions such as sse_client or streamablehttp_client. This design effectively turns the Chainlit server into an open proxy capable of making blind outbound requests to any service reachable from the deployment environment. Attackers can leverage this capability to issue authenticated requests against internal services by injecting attacker-controlled Authorization and Cookie headers, thereby bypassing authentication mechanisms on target systems that rely solely on header-based credentials rather than IP whitelisting or other contextual checks.
The operational impact of this vulnerability is severe, as it enables a range of malicious activities including server-side request forgery and network reconnaissance. Although the response from these outbound requests is consumed internally and not returned to the attacker in the HTTP response body, the side effects are significant. Attackers can perform state-changing operations on internal services by sending authenticated POST or PUT requests with crafted headers. Furthermore, they can use the vulnerable server as a pivot point to discover hidden internal services, scan open ports within private networks, and probe cloud metadata endpoints such as AWS EC2 instance metadata service version 2 (IMDSv2) to steal temporary security credentials and escalate privileges across the infrastructure.
This vulnerability maps directly to CWE-918 Server-Side Request Forgery due to the ability to force the server to make requests on behalf of an attacker, and CWE-749 Exposed Dangerous Method for allowing unauthenticated access to sensitive functionality. In terms of offensive security frameworks, it aligns with MITRE ATT&CK technique T1506 Defense Discovery, as attackers can probe internal infrastructure, and potentially T1078 Valid Accounts if the forged requests successfully authenticate against downstream services using stolen or crafted credentials. The SSE URL sink has been present since version 2.4.0rc0, while the specific capabilities for attacker-controlled header forwarding and streamable HTTP support were introduced in version 2.6.4, expanding the window of exposure over time.
To mitigate this risk, organizations must upgrade to Chainlit version 2.12.0 or later, where these flaws have been addressed with proper input validation and access controls. For deployments that cannot immediately update, it is imperative to ensure that features.mcp.enabled remains set to false unless absolutely necessary for specific use cases requiring external tool integration. Additionally, network-level protections such as firewall rules should be implemented to restrict outbound traffic from the Chainlit server instance to only known and trusted internal endpoints, thereby limiting the blast radius even if an attacker manages to exploit the unauthenticated endpoint. Regular security audits of configuration files are also recommended to prevent accidental exposure of sensitive features in production environments.