CVE-2026-120492 Chainlit CVE debrief

Who should care

Defenders responsible for Chainlit deployments, especially those with MCP enabled, should assess exposure and prioritize upgrading to version 2.12.0 or later. They should also monitor for unusual outbound HTTP requests and implement compensating controls to limit SSRF impact. Additionally, defenders should review relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the

Why it matters

CVE-2026-120492 is a critical SSRF vulnerability in Chainlit's MCP SSE and streamable-http transports. When MCP is enabled, an unauthenticated attacker can force the Chainlit server to make outbound HTTP requests to arbitrary URLs, including internal network services and cloud metadata endpoints, with attacker-controlled HTTP headers. Defenders should prioritize verifying if their Chainlit deployment has MCP enabled and upgrading to version 2.12.0 or later.

• Unauthenticated internal network access
• Potential data breaches through cloud metadata endpoints
• SSRF amplification with attacker-controlled headers
• Need for verification of affected versions and exposure

Technical summary

The vulnerability exists in the `POST /mcp` endpoint for `sse` and `streamable-http` transports when MCP is enabled. The endpoint accepts a user-controlled `url` and optional `headers` dictionary without validation, allowing an unauthenticated attacker to force the Chainlit server to make outbound HTTP requests to arbitrary URLs, including internal network services and cloud metadata endpoints, with attacker-controlled HTTP headers. Affected versions are >=2.4.0rc0, <2.12.0 for URL-based SSRF and >=2.6.4, <2.12.0 for attacker-controlled header forwarding. Defenders should prioritize verifying if their Chainlit deployment has MCP enabled and upgrading to version 2.12.0 or later.

Defensive priority

Defenders should prioritize verifying if their Chainlit deployment has MCP enabled and upgrading to version 2.12.0 or later. They should also monitor for unusual outbound HTTP requests and implement compensating controls to limit SSRF impact.

Recommended defensive actions

• Verify if MCP is enabled in your Chainlit deployment
• Upgrade to Chainlit version 2.12.0 or later
• Monitor for unusual outbound HTTP requests
• Implement compensating controls to limit SSRF impact
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the `POST /mcp` endpoint for `sse` and `streamable-http` transports when MCP is enabled. The endpoint accepts a user-controlled `url` and optional `headers` dictionary without validation. Affected versions are >=2.4.0rc0, <2.12.0 for URL-based SSRF and >=2.6.4, <2.12.0 for attacker-controlled header forwarding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.