CVE-2026-45019: CVE-2026-45019: Server-Side Request Forgery (SSRF) in Chainlit MCP Endpoint

#security #cve #cybersecurity

CVE-2026-45019: Server-Side Request Forgery (SSRF) in Chainlit MCP Endpoint

Vulnerability ID: CVE-2026-45019
CVSS Score: 7.2
Published: 2026-08-25

An unauthenticated server-side request forgery (SSRF) vulnerability exists in Chainlit versions >= 2.4.0rc0 and < 2.12.0 when the Model Context Protocol (MCP) features are enabled. This vulnerability allows remote, unauthenticated attackers to force the backend application server to initiate arbitrary HTTP/HTTPS connections to internal subnets, localhost endpoints, or cloud metadata infrastructure.

TL;DR

Unauthenticated attackers can abuse the Model Context Protocol (MCP) endpoint in Chainlit to execute arbitrary HTTP requests to internal networks and local interfaces.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-918
Attack Vector: Network
CVSS: 7.2
EPSS: Not Available
Impact: Server-Side Request Forgery (SSRF)
Exploit Status: PoC
KEV Status: Not Listed

Affected Systems

Chainlit server deployments with features.mcp.enabled = true
Chainlit: >= 2.4.0rc0, < 2.12.0 (Fixed in: 2.12.0)

Code Analysis

Commit: 0565fd0

Close vulnerability related to user MCP servers (SSRF and header injection)

Mitigation Strategies

Upgrade Chainlit to version 2.12.0 or later
Disable the Model Context Protocol (MCP) in the config file if not required
Implement local egress firewall rules blocking requests to 127.0.0.1 and 169.254.169.254
Ensure authentication is required to access the Chainlit interface

Remediation Steps:

Review .chainlit/config.toml and set features.mcp.enabled = false.
Update the project dependencies using pip install --upgrade chainlit to fetch version 2.12.0.
Restrict outbound network traffic from the application container using firewall software.

References

Read the full report for CVE-2026-45019 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community