GHSA-hvfh-5mj3-5f3j Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

• PyPI chainlit: >= 2.4.0rc0, < 2.12.0 → fixed in 2.12.0

Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: `/mcp` is reachable by any client that can open a session. Summary When MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `sse` and `streamable-http` transports accepts a user-controlled `url` and optional `headers` dictionary without any validation. An unauthenticated attacker can force the Chainlit server to make outbound HTTP requests to arbitrary URLs — including internal network services and cloud metadata endpoints — with attacker-controlled HTTP headers such as `Authorization` and `Cookie`. Affected / patched versions | | | |---|---| | CVE | CVE-2026-45019 | | Affected — URL-based SSRF | `>=2.4.0rc0, =2.6.4, Breaking change. 2.12.0 changes how MCP servers are configured. If `.chainlit/config.toml` still uses the legacy `[features.mcp.sse]`, `[features.mcp.stdio]`, or `[features.mcp.streamable-http]` sections, or the `allowed_executables` setting, the application will fail to start once MCP is enabled, until you migrate to the new `[[features.mcp.servers]]` / `allowed_urls` configuration. See the migration guide in `CHANGELOG.md` before upgrading. Deployments with `features.mcp.enabled = false` are not affected by this startup check. Residual risk after upgrading • On deployments with no authentication configured, `/mcp` remains reachable anonymous…