PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45019 Chainlit CVE debrief

CVE-2026-45019 is a Server-Side Request Forgery (SSRF) vulnerability in Chainlit, a Python framework for building conversational AI applications. The vulnerability affects Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml, exposing the POST /mcp endpoint without requiring authentication. This allows an attacker to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers.

Vendor
Chainlit
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-09
Advisory published
2026-08-25
Advisory updated
2026-09-09

Who should care

Defenders responsible for Chainlit deployments, conversational AI applications, and internal service security should assess exposure and apply the fix. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams that need to verify exposure, assess network reach, and apply the fix in version 2.12.0.

Why it matters

CVE-2026-45019 is a high-severity SSRF vulnerability in Chainlit that allows attackers to make blind outbound requests to internal or external services. Defenders should prioritize verifying exposure, assessing network reach, and applying the fix in version 2.12.0.

  • Potential for unauthorized access to internal services
  • Risk of sensitive data exposure through metadata endpoints
  • Possibility of port scanning and service discovery
  • Need for verification of affected versions and exposure

Technical summary

The vulnerability affects Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml. The POST /mcp endpoint is exposed without requiring authentication, allowing an attacker to make blind outbound requests to arbitrary internal or external services. The connect_mcp handler passes user-controlled URL and optional headers to sse_client() or streamablehttp_client(), enabling state-changing authenticated requests, service discovery, port scanning, and metadata endpoint probing.

Defensive priority

Defenders should prioritize verifying exposure of the /mcp endpoint, assessing the network reach of affected Chainlit deployments, and applying the fix in version 2.12.0.

Recommended defensive actions

  • Verify exposure of the /mcp endpoint in Chainlit deployments
  • Assess network reach of affected deployments
  • Apply fix in version 2.12.0
  • Review and update .chainlit/config.toml configurations
  • Perform vulnerability scanning to identify potential internal services
  • Monitor for suspicious activity related to the /mcp endpoint
  • Review access controls for the /mcp endpoint

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The Chainlit security advisory provides additional context on the vulnerability and mitigation steps.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45019 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45019

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45019 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45019

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.