Authentication Bypass in Chainlit Python Framework Exposes Sensitive Endpoints
CVE-2026-45019

7.2HIGH

Key Information:

Vendor

Chainlit

Status
Chainlit
Vendor
CVE Published:
25 August 2026

What is CVE-2026-45019?

The Chainlit Python framework, used for building conversational AI applications, has a significant security vulnerability where deployments can unintentionally expose sensitive endpoints. Versions from 2.4.0rc0 up to 2.12.0 allow unauthenticated access to the POST /mcp endpoint when the features.mcp.enabled setting is active. The lack of proper validation for user-controlled URLs and headers enables attackers to perform server-side request forgery (SSRF), making the Chainlit server vulnerable to malicious requests. This allows potential attackers to discover internal services, issue state-changing requests, and exploit cloud metadata endpoints. The issue has been addressed in version 2.12.0 of the Chainlit framework.

Affected Version(s)

chainlit >= 2.4.0rc0, < 2.12.0

References

https://github.com/Chainlit/chainlit/security/advisories/...
x_refsource_CONFIRM
https://github.com/Chainlit/chainlit/commit/0565fd0eccb91...
x_refsource_MISC
https://github.com/Chainlit/chainlit/blob/2.12.0/docs/sec...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.