Chainlit has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
- Product
- Chainlit
- CVE
- CVE-2026-45019
- Affected
- chainlit 2.4.0rc0 to 2.11.1
- Fixed in
- 2.12.0
Last verified against sources: October 26, 2026
Am I affected?
Chainlit: affected chainlit 2.4.0rc0 to 2.11.1. Fixed in 2.12.0.
- Check your version: run
pip show chainlit. Versions >= 2.4.0rc0, <= 2.11.1 of chainlit are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "chainlit>=2.12.0"(first patched version 2.12.0). [1] - Upgrade to Chainlit 2.12.0. [1]
- Set
features.mcp.enabled = falsein.chainlit/config.toml. [1] - Restrict outbound network egress from the host running Chainlit. [1]
- Configure authentication (register an auth callback) so that
/mcprequires an authenticated session. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- When MCP is enabled (
features.mcp.enabled = true), thePOST /mcpendpoint forsseandstreamable-httptransports accepts a user-controlledurland optionalheadersdictionary without any validation. [1] - MCP has been disabled by default since v2.7.0. [1]
- The SSE URL sink has existed since MCP support was first introduced in v2.4.0rc0. [1]
- This is a blind SSRF: the server makes the outbound request, but the response is consumed internally by the MCP client and never returned to the attacker. [1]
Impact
- An unauthenticated attacker can force the Chainlit server to make outbound HTTP requests to arbitrary URLs — including internal network services and cloud metadata endpoints — with attacker-controlled HTTP headers such as
AuthorizationandCookie. [1] - The same primitive also enables internal service discovery, port scanning, and probing cloud metadata endpoints. [1]
What was done
Sources
- GHSA-hvfh-5mj3-5f3j — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-45019] Chainlit has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Product: Chainlit | Affected: chainlit 2.4.0rc0 to 2.11.1 | Fixed in: 2.12.0
Summary: When MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `sse` and `streamable-http` transports accepts a user-controlled `url` and optional `headers` dictionary without any validation.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/08/cve-2026-45019-chainlitCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-45019
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.