p PatchFirst

CVE-2026-45019

CVE-2026-45019 · Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect_mcp handler in backend/chainlit/server.py passes these values to sse_client() or streamablehttp_client(), allowing the Chainlit server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker-controlled Authorization and Cookie headers. The SSE URL sink has existed since 2.4.0rc0, while attacker-controlled header forwarding and streamable-http support were added in 2.6.4. The response is consumed internally and not returned, but the attacker can issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints. This issue is fixed in version 2.12.0.

CVSS 7.2 · Hoch · EPSS 0,4% · Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: python

Betroffene Produkte und Versionen

  • chainlit

    Softwareversionen
    • >= 2.4.0rc0, < 2.12.0: Betroffen

    Keine Korrektur veröffentlicht

  • chainlit PyPI

    Softwareversionen
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.11.1
    • 2.4.0
    • 2.4.0rc0
    • 2.4.1
    • 2.4.2
    • 2.4.201
    • 2.4.3
    • 2.4.301
    • 2.4.302
    • 2.4.400
    • 2.5.5
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    • 2.6.7
    • 2.6.8
    • 2.6.9
    • 2.7.0
    • 2.7.1
    • 2.7.1.1
    • 2.7.2
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 2.9.0
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    Betroffene Versionsbereiche
    • ECOSYSTEM: ≥ 2.4.0rc0, < 2.12.0

    Auf 2.12.0 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →