{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/chainlit-2.4.0rc0---2.11.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-45019"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Chainlit (2.4.0rc0 - 2.11.1)"],"_cs_severities":["high"],"_cs_tags":["ssrf","mcp","cve-2026-45019"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eChainlit, an open-source framework for building LLM chat interfaces, is vulnerable to a severe Server-Side Request Forgery (SSRF) flaw when the Model Context Protocol (MCP) feature is enabled. The vulnerability exists in the \u003ccode\u003ePOST /mcp\u003c/code\u003e endpoint, which handles \u003ccode\u003esse\u003c/code\u003e and \u003ccode\u003estreamable-http\u003c/code\u003e transports. When enabled via \u003ccode\u003efeatures.mcp.enabled = true\u003c/code\u003e, the application fails to validate the \u003ccode\u003eurl\u003c/code\u003e parameter and improperly forwards a user-supplied \u003ccode\u003eheaders\u003c/code\u003e dictionary to the internal HTTP client.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker can force the Chainlit server to execute arbitrary outbound HTTP requests. Because the server forwards attacker-supplied headers, including \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e, this vulnerability allows for unauthorized state-changing operations against internal services and provides a mechanism to probe sensitive cloud metadata endpoints (e.g., 169.254.169.254). The issue impacts all versions from 2.4.0rc0 up to, but not including, 2.12.0. Chainlit has addressed this by introducing a strict allowlist-based configuration model in version 2.12.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a connection to the target Chainlit server via Socket.IO or direct HTTP POST to \u003ccode\u003e/mcp\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON payload for the \u003ccode\u003e/mcp\u003c/code\u003e endpoint specifying \u003ccode\u003eclientType\u003c/code\u003e as \u003ccode\u003esse\u003c/code\u003e or \u003ccode\u003estreamable-http\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious \u003ccode\u003eurl\u003c/code\u003e parameter (e.g., pointing to an internal admin API or metadata service).\u003c/li\u003e\n\u003cli\u003eAttacker includes a \u003ccode\u003eheaders\u003c/code\u003e dictionary in the JSON payload containing sensitive authentication tokens or forged cookies.\u003c/li\u003e\n\u003cli\u003eChainlit backend receives the request and directly invokes the internal \u003ccode\u003esse_client\u003c/code\u003e or \u003ccode\u003estreamablehttp_client\u003c/code\u003e using the unsanitized parameters.\u003c/li\u003e\n\u003cli\u003eThe server initiates an outbound HTTP request from its local context to the specified internal target.\u003c/li\u003e\n\u003cli\u003eInternal service processes the forged request, effectively bypassing intended authentication/authorization constraints.\u003c/li\u003e\n\u003cli\u003eAttacker achieves unauthorized state change or sensitive data exfiltration against internal infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to bypass perimeter security to reach internal networks, probe cloud metadata endpoints, and perform state-changing operations against internal APIs. The lack of validation on both the target URL and the forwarded headers means an attacker can authenticate requests as the Chainlit server itself to downstream services. The impact is critical for deployments running in trusted internal network zones or cloud environments where the server instance holds identity-based permissions (e.g., IAM roles).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Chainlit deployments to version 2.12.0 immediately to implement the new strict allowlist-based MCP configuration.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, set \u003ccode\u003efeatures.mcp.enabled = false\u003c/code\u003e in \u003ccode\u003e.chainlit/config.toml\u003c/code\u003e to disable the vulnerable component.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network egress for the host running the Chainlit process, specifically blocking access to private IP ranges and the cloud metadata service (169.254.169.254).\u003c/li\u003e\n\u003cli\u003eMonitor server-side web logs for \u003ccode\u003ePOST\u003c/code\u003e requests to the \u003ccode\u003e/mcp\u003c/code\u003e endpoint originating from unexpected or untrusted sources.\u003c/li\u003e\n\u003cli\u003eEnable authentication callbacks for the application to ensure that \u003ccode\u003e/mcp\u003c/code\u003e endpoints are not accessible to unauthenticated sessions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-26T00:51:03Z","date_published":"2026-08-26T00:51:03Z","id":"https://feed.craftedsignal.io/briefs/2026-08-chainlit-ssrf/","summary":"Chainlit versions 2.4.0rc0 through 2.11.1 contain an unauthenticated SSRF vulnerability (CVE-2026-45019) in the Model Context Protocol (MCP) component, allowing attackers to perform internal network reconnaissance and interact with internal APIs using attacker-controlled HTTP headers.","title":"Unauthenticated SSRF in Chainlit MCP Component","url":"https://feed.craftedsignal.io/briefs/2026-08-chainlit-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Chainlit (2.4.0rc0 - 2.11.1)","version":"https://jsonfeed.org/version/1.1"}