CVE-2026-22219: Chainlit SSRF Vulnerability

CVE-2026-22219 Overview

CVE-2026-22219 is a server-side request forgery (SSRF) vulnerability in Chainlit versions prior to 2.9.4. The flaw resides in the /project/element update flow when the application is configured with the SQLAlchemy data layer backend. An authenticated client can supply a user-controlled url value inside an Element, which the SQLAlchemy element creation logic fetches using an outbound HTTP GET request. Attackers can pivot this primitive to reach internal network services or cloud metadata endpoints. Retrieved responses are then persisted through the configured storage provider, enabling exfiltration of sensitive data. The vulnerability is classified under CWE-918.

Critical Impact

Authenticated attackers can force the Chainlit server to issue arbitrary HTTP requests to internal services and cloud metadata endpoints, then retrieve the responses via the storage provider.

Affected Products

• Chainlit versions prior to 2.9.4
• Deployments configured with the SQLAlchemy data layer backend
• Chainlit instances exposing the /project/element update flow to authenticated users

Discovery Timeline

• 2026-01-20 - CVE-2026-22219 published to NVD
• 2026-02-02 - Last updated in NVD database

Technical Details for CVE-2026-22219

Vulnerability Analysis

Chainlit is an open-source framework for building conversational AI applications. When operators enable the SQLAlchemy data layer, the framework persists chat Elements through an ORM-backed flow. The element creation handler accepts a url field on incoming Element objects and treats it as a remote resource to fetch. The server then issues an outbound HTTP GET request to that URL without validating the destination host, scheme, or address family. The fetched response body is written to the configured storage provider as if it were legitimate Element content. This combination converts a feature designed for remote asset ingestion into a full-read SSRF primitive against any network destination reachable from the Chainlit host.

Root Cause

The root cause is missing validation of user-controlled URLs within the SQLAlchemy element creation logic. The handler trusts the url value supplied by the authenticated client and dispatches an HTTP request without enforcing an allowlist, blocking private address ranges, or rejecting link-local metadata addresses such as 169.254.169.254. Storing the response through the storage provider compounds the impact by giving the attacker a reliable channel to retrieve the data.

Attack Vector

An authenticated attacker submits an Element with a crafted url pointing to an internal target. Typical targets include cloud instance metadata services (IMDS), internal admin APIs on loopback or RFC1918 ranges, and unauthenticated internal HTTP services. The Chainlit server performs the request from its own network position, bypassing perimeter controls. The attacker then reads the stored object to obtain credentials, tokens, or internal service responses. The vulnerability mechanism is documented in the VulnCheck Security Advisory and the Zafran Analysis on Chainleak Vulnerabilities.

Detection Methods for CVE-2026-22219

Indicators of Compromise

• Outbound HTTP GET requests from the Chainlit server to private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.169.254.
• Element records in the SQLAlchemy data layer containing url values referencing internal hostnames, loopback addresses, or cloud metadata endpoints.
• Unexpected objects in the configured storage provider whose contents match instance metadata, IAM credentials, or internal API responses.

Detection Strategies

• Inspect Chainlit application logs for /project/element requests followed by outbound HTTP fetches to non-public destinations.
• Correlate egress proxy or VPC flow logs with Chainlit server identity to surface requests to IMDS endpoints.
• Audit stored Element artifacts for response bodies that resemble JSON metadata documents or temporary cloud credentials.

Monitoring Recommendations

• Alert on any outbound request from Chainlit workloads to 169.254.169.254, metadata.google.internal, or Azure IMDS hosts.
• Track creation of Element objects whose url field resolves to internal IPs and flag the corresponding storage writes.
• Forward Chainlit, egress proxy, and cloud audit logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-22219

Immediate Actions Required

• Upgrade Chainlit to version 2.9.4 or later, which contains the fix referenced in the GitHub Release 2.9.4 notes.
• Rotate any cloud credentials, API tokens, or session secrets accessible from the Chainlit host's metadata service.
• Review stored Element artifacts for content sourced from internal endpoints and purge unauthorized objects.

Patch Information

Chainlit 2.9.4 addresses the SSRF in the SQLAlchemy data layer element creation path. Operators should deploy this release across all Chainlit instances using the SQLAlchemy backend. The patch and associated notes are available in the GitHub Release 2.9.4 and the VulnCheck Security Advisory.

Workarounds

• Restrict egress from Chainlit workloads to an explicit allowlist that excludes RFC1918, loopback, and link-local ranges.
• Enforce IMDSv2 with hop-limit 1 on AWS, or equivalent metadata protections on Azure and GCP, to prevent SSRF-based credential theft.
• Limit authenticated access to the /project/element endpoint to trusted operators until the upgrade is complete.
• Disable the SQLAlchemy data layer in environments where it is not required.