CVE-2026-45019

Name of the Vulnerable Software and Affected Versions Chainlit versions 2.4.0rc0 through 2.11.x

Description Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the 'POST /mcp' endpoint without authentication. The ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect mcp() handler in backend/chainlit/server.py passes these values to sse client() or streamablehttp client(), enabling the server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, using attacker-controlled Authorization and Cookie headers. This allows attackers to issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints.

Recommendations Update to version 2.12.0. As a temporary workaround, set features.mcp.enabled to false in .chainlit/config.toml to disable the vulnerable functionality.