GHSA-hvfh-5mj3-5f3j: Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Summary

Chainlist, the Chainlit MCP server component, contains a blind SSRF (CVE-2026-45019) in the POST /mcp endpoint for the sse and streamable-http transports when features.mcp.enabled is true. The endpoint accepts an unvalidated, user-controlled url and headers dictionary, and passes them to the MCP SDK's sse_client() or streamablehttp_client(), letting an unauthenticated attacker make the server send requests with attacker-chosen headers such as Authorization and Cookie. Affected ranges are >=2.4.0rc0 for URL-based SSRF and >=2.6.4 for header forwarding, both before 2.12.0.

Mitigation

Fixed in 2.12.0 (releasing 2026-08-25).

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• chainlitPyPILLM dependency since 2025-03-09 · 2 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online