CVE-2026-45019: Chainlit server-side request forgery via MCP transports

CVE-2026-45019 · Severity: high · CVSS 7.2 · Published 2026-08-25

Chainlit is an open-source framework for building conversational AI applications. When its optional Model Context Protocol (MCP) feature is enabled, an unauthenticated user can trick the Chainlit server into making HTTP requests to any destination with attacker-controlled headers. Although the server does not return response bodies to the attacker, they can craft requests (e.g., with forged Authorization headers) that modify internal services, discover network topology, or probe cloud infrastructure metadata. This could lead to unauthorized access to internal systems or data exposure.

Technologies: Chainlit, chainlit (PyPI). Vendors: Chainlit, PyPI.

Quick answers

Is CVE-2026-45019 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45019 being exploited in the wild.
How severe is CVE-2026-45019?
High severity, with a CVSS score of 7.2, published 25 August 2026.
Which products and versions are affected?
Chainlit >=2.4.0rc0, <2.12.0; chainlit (PyPI) ECOSYSTEM:introduced=2.4.0rc0,fixed=2.12.0.
Is there a fix for CVE-2026-45019?
Yes. chainlit (PyPI): upgrade to 2.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45019 attacked?
It is attacked over the network.
Am I affected by CVE-2026-45019?
Check whether you run Chainlit or chainlit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • chainlit (PyPI): upgrade to 2.12.0 or later
    pip install "chainlit>=2.12.0"

Technical details

The vulnerability exists in Chainlit's MCP endpoint handler (backend/chainlit/server.py) which accepts a user-supplied URL and optional headers dictionary and passes them directly to the MCP SDK's sse_client() or streamablehttp_client() functions without validation. The Pydantic request model (backend/chainlit/types.py) defines url as a bare string with no scheme validation, private IP filtering, or allowlist. The SSE URL sink has existed since MCP was introduced in v2.4.0rc0; attacker-controlled header forwarding was added in v2.6.4. Exploitation requires only an open Socket.IO session and POST access to /mcp—no authentication is required. An attacker can force POST requests with arbitrary headers (Authorization, Cookie, X-Forwarded-*, etc.) to internal addresses, cloud metadata endpoints (e.g., 169.254.169.254 for AWS IMDSv1), or network-adjacent services. The fix in v2.12.0 introduces an allowlist-based model requiring explicit opt-in and validation of destination URLs.

Affected products

  • Chainlit Chainlit >=2.4.0rc0, <2.12.0

Identifiers

  • CVE-2026-45019
  • GHSA-hvfh-5mj3-5f3j
  • PYSEC-2026-3811

Timeline

  • 2026-08-25: disclosed: CVE-2026-45019 published via GitHub Advisory GHSA-hvfh-5mj3-5f3j
  • 2026-08-25: patched: Chainlit 2.12.0 released with allowlist-based mitigation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.