EUVD-2026-115226
GHSA-xhx7-9vjr-p2h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /mcp endpoint unauthenticated
-
DeliveryCraft MCP url with '..;' path segment
-
ExploitPass validate_mcp_url semicolon gap
-
ExecutionBypass path-scoped allowed_urls grant
-
ImpactServer requests out-of-grant path on allowlisted origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Chainlit deployment with MCP enabled (features.mcp.enabled = true - disabled by default since v2.7.0) AND user-provided servers enabled (features.mcp.user_servers.enabled = true) with a non-empty allowed_urls allowlist that uses path-scoped entries. The bypass only succeeds against a target origin that strips semicolon path parameters, so hosts that preserve ';' are not reachable this way. Where no auth callback is registered, /mcp is reachable anonymously (no authentication required, per the CVSS PR:N). Limiting factors: all MCP user-server features are opt-in and deny-all by default, impact is confined to paths on origins already present in the operator's allowlist, and the SSRF is blind (no response returned), bounding this well below the unrestricted parent SSRF. |
| Impact | Signals point consistently to a low-to-moderate, conditional issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium) and notably sets vulnerable-system impact to none (VC:N/VI:N/VA:N) with only subsequent-system confidentiality/integrity as Low (SC:L/SI:L) - meaning this is not the full SSRF but a narrower allowlist-scoping bypass. The vuln.today Decision label is 'monitor', which aligns with that limited impact. The AT:P (attack requirement present) metric is justified by the description: exploitation only works 'on origins that strip semicolon path parameters', an attacker-uncontrolled property of the targeted host, so this is not reliably exploitable everywhere. No EPSS score and no KEV listing were provided in the input, so there is no evidence of active or widespread exploitation. A PoC is present in the GHSA evidence, but it demonstrates the broader parent SSRF (CVE-2026-45019) against 2.11.0, not the semicolon '..;' path bypass that defines this CVE. Net: this is a hardening/bypass-class defect gated behind a non-default, opt-in feature, correctly prioritized as monitor rather than act_now. |
| Exploit ScenarioDerived | On a Chainlit 2.12.0 deployment with MCP and user-provided servers enabled, an unauthenticated attacker submits an MCP URL containing a '..;' segment to the /mcp endpoint. Because validate_mcp_url does not reject the semicolon, the URL passes the path-prefix check but, against an origin that strips semicolon path parameters, the server issues a request to a path outside the operator's allowlist grant. The SSRF is blind, so the response is not returned to the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Server-side request forgery in Chainlit's MCP client path lets an unauthenticated remote user slip past path-scoped allowed_urls grants by embedding '..;' segments in the user-supplied MCP URL posted to /mcp, because validate_mcp_url does not reject the semicolon character; on origins that strip semicolon path parameters the request lands on a path outside the operator's grant. Exposure is narrow and opt-in: MCP must be enabled (features.mcp.enabled = true, off by default since v2.7.0), user-provided servers must be enabled with a non-empty allowed_urls allowlist, and the target origin must discard ';' parameters, so reach is confined to paths on hosts the operator already allowlisted, and the SSRF is blind. No public exploit code was identified at time of analysis and no EPSS or KEV signal is present; the priority label is monitor, consistent with a low-to-moderate, conditional issue rather than an urgent one.
RemediationAI
Apply the upstream fix in commit 0565fd0eccb915fce159929598b053ed79f6e0c9, which closes the semicolon canonicalization gap in validate_mcp_url; note that this is an upstream commit fix and a released patched version is not independently confirmed, so verify the tagged release before relying on a package upgrade. If you cannot patch immediately, the most complete mitigation stated by the maintainers is setting features.mcp.enabled = false in .chainlit/config.toml, which removes the /mcp outbound path entirely at the cost of disabling all MCP integrations (including developer-configured servers). Because the bypass requires user-provided servers, leaving features.mcp.user_servers.enabled = false (the deny-all default) or narrowing allowed_urls to full paths on origins that preserve ';' parameters reduces reach, with the trade-off that user-supplied MCP connections stop working and some legitimate grants may need to be re-scoped. Restricting outbound egress from the Chainlit host, such as firewall rules blocking internal address ranges and the cloud metadata endpoint at 169.254.169.254, bounds the destination set but does not prevent requests to allowlisted hosts, and registering an auth callback so /mcp requires an authenticated session removes the anonymous attack path without eliminating SSRF for authenticated users. Consult https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j for the migration guidance before upgrading, since the 2.12.0 allowlist model introduced breaking configuration changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chainlit exposes a POST /mcp endpoint that accepts a caller-supplied url and headers for the sse and streamable-http MCP transports, and hands them to the MCP SDK's sse_client()/streamablehttp_client() to make outbound requests from the server. The allowlist design shipped in 2.12.0 is implemented by validate_mcp_url (backend/chainlit/mcp.py, lines 90-177, with related handling at lines 199-208), which matches scheme/host/port and a path prefix against the operator's allowed_urls entries, strips a set of restricted headers, disables redirect following, and re-checks each transport request against the connection grant. This is a CWE-918 server-side request forgery: the validator's canonicalization is incomplete because it does not reject the semicolon character, so a URL whose path contains '..;' is accepted as within the approved path prefix. Whether the traversal actually materializes depends on the destination origin's path handling - servers that strip semicolon path parameters re-interpret the segment as a parent-directory traversal and route the request elsewhere on that same origin; origins that preserve ';' are not reachable this way. The result is a blind SSRF: the response is consumed internally by the MCP client and never returned to the attacker, so the impact is limited to the ability to issue requests, potentially state-changing ones, to other paths on already-trusted hosts. The trigger mechanics beyond the semicolon canonicalization gap are not described in the available sources.
Know when Chainlit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Unauthenticated network-reachable /mcp gives AV:N/PR:N/UI:N, but the bypass depends on the target origin stripping semicolon params (AC:H); the SSRF crosses scope (S:C) with only limited reachable-path confidentiality/integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to t
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attac
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Cha
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenti
Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursive
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other u
Exploit-DB