CVE-2026-45019: Chainlit SSRF Vulnerability

CVE-2026-45019 Overview

CVE-2026-45019 is a Server-Side Request Forgery (SSRF) vulnerability in Chainlit, a Python framework for building production-ready conversational AI applications. Versions from 2.4.0rc0 through 2.12.0 expose the POST /mcp endpoint without authentication when features.mcp.enabled is set to true in .chainlit/config.toml. The endpoint accepts a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. Attackers can force the Chainlit server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers. The issue is fixed in version 2.12.0.

Critical Impact
Unauthenticated attackers can pivot into internal networks, reach cloud instance metadata services, scan ports, and issue state-changing authenticated requests to internal APIs through the Chainlit server.

Affected Products

Chainlit 2.4.0rc0 through versions before 2.12.0 (SSE transport SSRF sink)
Chainlit 2.6.4 through versions before 2.12.0 (streamable-http transport and attacker-controlled header forwarding)
Any Chainlit deployment with features.mcp.enabled = true in .chainlit/config.toml

Discovery Timeline

2026-08-25 - CVE-2026-45019 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-45019

Vulnerability Analysis

The vulnerability resides in the Model Context Protocol (MCP) connection handler exposed at POST /mcp. The endpoint is reachable without authentication whenever the MCP feature flag is enabled. Request models ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a URL and a headers dictionary supplied entirely by the client. The connect_mcp handler in backend/chainlit/server.py forwards those values directly to sse_client() or streamablehttp_client(). No scheme validation, DNS resolution check, or private-address filter is applied before the outbound request is made. The server initiates the request, allowing attackers to reach http://169.254.169.254/latest/meta-data/ on AWS, GCP metadata endpoints, internal Kubernetes services, and localhost management interfaces. Although the response body is consumed internally and not returned to the caller, side effects, timing, and error signals allow reconnaissance and state-changing operations against authenticated internal APIs.

Root Cause

The underlying weakness is classified as [CWE-918] Server-Side Request Forgery. User-supplied URLs and headers flow into HTTP client factories without validation. The SSE sink has existed since 2.4.0rc0; attacker-controlled header forwarding and the streamable-http transport were added in 2.6.4, expanding the attack surface to include arbitrary Authorization and Cookie headers on outbound requests.

Attack Vector

An unauthenticated remote attacker sends a crafted POST /mcp request specifying a sse or streamable-http transport, a target URL pointing at an internal host or cloud metadata endpoint, and headers containing forged credentials. The Chainlit backend performs the outbound request on the attacker's behalf, permitting internal service discovery, port scanning, metadata credential probing, and authenticated state-changing calls.

python

# Patch excerpt: backend/chainlit/types.py
from dataclasses import field

from dataclasses_json import DataClassJsonMixin
from pydantic import BaseModel, model_validator
from pydantic.dataclasses import dataclass

InputWidgetType = Literal[
# Source: https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9

The patch introduces model_validator in the MCP request models to enforce scheme, host, and header validation before the outbound request is issued. A companion change in backend/chainlit/session.py adds a bounded stop_mcp_task helper so the /mcp connect handler can cleanly tear down connections that hit timeout or blocked-destination failure paths.

Detection Methods for CVE-2026-45019

Indicators of Compromise

Unauthenticated POST /mcp requests in Chainlit access logs containing url values pointing at RFC1918 addresses, 127.0.0.1, localhost, 169.254.169.254, or metadata.google.internal
Outbound connections from the Chainlit process to cloud metadata endpoints or internal management ports
Anomalous Authorization or Cookie header values submitted in MCP connect payloads

Detection Strategies

Inspect reverse proxy and application logs for POST /mcp traffic that specifies sse or streamable-http transport with non-public destinations
Correlate Chainlit process network telemetry with expected MCP server endpoints and alert on deviations
Deploy egress firewall rules that log denied connections from the Chainlit host to metadata IP ranges

Monitoring Recommendations

Enable outbound DNS and HTTP logging on hosts running Chainlit and forward events to a centralized analytics platform for baselining
Monitor for repeated short-duration outbound requests from Chainlit to sequential internal IPs, indicating port scanning
Alert on any Chainlit process request to 169.254.169.254 or equivalent cloud metadata addresses

How to Mitigate CVE-2026-45019

Immediate Actions Required

Upgrade Chainlit to version 2.12.0 or later
If upgrade is not immediately possible, set features.mcp.enabled = false in .chainlit/config.toml to disable the vulnerable endpoint
Place Chainlit behind an authenticating reverse proxy and restrict access to POST /mcp to trusted identities
Apply egress network controls that block Chainlit hosts from reaching cloud metadata endpoints and internal management ranges

Patch Information

The fix is committed in Chainlit Commit 0565fd0 and released in Chainlit Release 2.12.0. Additional context is available in the GitHub Security Advisory GHSA-hvfh-5mj3-5f3j and the Chainlit Security Advisory SPL-2026-002.

Workarounds

Disable the MCP feature by setting features.mcp.enabled = false until the patched version can be deployed
Enforce IMDSv2 on AWS workloads so that stolen tokens from blind SSRF cannot retrieve metadata credentials
Restrict outbound egress from the Chainlit host to a strict allowlist of known-good MCP server destinations

bash

# Configuration example: disable MCP feature in .chainlit/config.toml
[features.mcp]
enabled = false

# Verify installed Chainlit version
pip show chainlit | grep -i version

# Upgrade to the patched release
pip install --upgrade "chainlit>=2.12.0"