Executive brief
Chainlit is an open-source framework for building conversational AI applications. When its optional Model Context Protocol (MCP) feature is enabled, an unauthenticated user can trick the Chainlit server into making HTTP requests to any destination with attacker-controlled headers. Although the server does not return response bodies to the attacker, they can craft requests (e.g., with forged Authorization headers) that modify internal services, discover network topology, or probe cloud infrastructure metadata. This could lead to unauthorized access to internal systems or data exposure.
Technical details
The vulnerability exists in Chainlit's MCP endpoint handler (backend/chainlit/server.py) which accepts a user-supplied URL and optional headers dictionary and passes them directly to the MCP SDK's sse_client() or streamablehttp_client() functions without validation. The Pydantic request model (backend/chainlit/types.py) defines url as a bare string with no scheme validation, private IP filtering, or allowlist. The SSE URL sink has existed since MCP was introduced in v2.4.0rc0; attacker-controlled header forwarding was added in v2.6.4. Exploitation requires only an open Socket.IO session and POST access to /mcp—no authentication is required. An attacker can force POST requests with arbitrary headers (Authorization, Cookie, X-Forwarded-*, etc.) to internal addresses, cloud metadata endpoints (e.g., 169.254.169.254 for AWS IMDSv1), or network-adjacent services. The fix in v2.12.0 introduces an allowlist-based model requiring explicit opt-in and validation of destination URLs.
Affected products
- Chainlit Chainlit >=2.4.0rc0, <2.12.0
Timeline
- 2026-08-25: disclosed: CVE-2026-45019 published via GitHub Advisory GHSA-hvfh-5mj3-5f3j
- 2026-08-25: patched: Chainlit 2.12.0 released with allowlist-based mitigation