Chainlit CVE-2026-82290

Exploitation requires an active authenticated session on the target Chainlit instance - unauthenticated actors cannot exploit this flaw (PR:L per CVSS 4.0 vector). The attacker must also be able to identify or enumerate valid feedback record identifiers belonging to other users; the AT:P designation in the CVSS 4.0 vector indicates this discovery step imposes some real-world complexity, particularly if identifiers are non-sequential UUIDs. No elevated role or administrative privilege is required beyond standard user authentication. Exploitation is only meaningful in multi-user deployments where other users have submitted feedback records; single-user instances have no cross-user data to corrupt. There is no evidence of remote code execution or confidentiality breach - impact is strictly limited to integrity of the feedback dataset.

The CVSS 4.0 base score of 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) reflects a network-reachable flaw with constrained complexity: exploitation requires a valid authenticated session (PR:L) and the ability to identify or enumerate valid feedback record identifiers belonging to other users (AT:P). VI:H is the dominant impact signal - an attacker can silently erase or falsify human preference data that feeds downstream model evaluation or reinforcement learning pipelines, a form of data poisoning with no confidentiality or availability footprint to trigger conventional alerting. No CISA KEV listing exists and no public proof-of-concept has been identified, meaning real-world exploitation risk is presently moderate rather than urgent. The AC:H and AT:P constraints suggest this is not trivially automatable at scale - opportunistic mass exploitation is unlikely without ID enumeration capability. That said, organizations with multi-user Chainlit deployments where feedback data integrity is load-bearing for model quality decisions - even a mid-sized AI operations team - should treat remediation as a near-term priority given the silent, difficult-to-detect nature of the data corruption and the absence of a confirmed patch.

An authenticated Chainlit user scripts a series of PUT or DELETE requests to the feedback API, cycling through numeric or UUID-format feedback identifiers to locate and overwrite records belonging to other users. By selectively deleting high-quality positive feedback or injecting false negative ratings, the attacker skews the human preference dataset consumed by a downstream RLHF or model evaluation pipeline without triggering any authentication error. No public proof-of-concept has been confirmed, but the attack requires only standard HTTP tooling and a valid session token.