Chainlit MCP Command Injection & SSRF Vulnerabilities (SPL-2026-001/002)

Vulnerability Overview Vulnerability ID: SPL-2026-001 / SPL-2026-002 Severity: - SPL-2026-001: Critical (CVSS v3.1: 9.8) - SPL-2026-002: High (CVSS v3.1: 7.2) Affected Versions: v2.4.0rc0 - v2.11.x (all versions with ) Fixed Version: v2.12.0 Reporter: SPL Security (vipin@spl.team, stephen@spl.team) Disclosure Date: 2026-04-08 Impact Analysis SPL-2026-001 - Command Injection via MCP stdio - Description: The endpoint accepts a user-supplied string when is "stdio". Validation is limited to checking if the executable filename is in a configurable whitelist; arguments are not filtered. - Impact: An unauthenticated remote attacker can execute arbitrary shell commands on the Chainlit server with the privileges of the Chainlit process. This allows reading and writing files, stealing secrets, installing backdoors, and pivoting into the internal network. - Affected Configuration: Any Chainlit deployment with MCP enabled ( ). MCP has been disabled by default since v2.7.0. SPL-2026-002 - SSRF via MCP streamable-http / SSE - Description: The endpoint accepts arbitrary and headers from the client when is "sse" or "streamable-http". The URL is passed directly to the HTTP client of the MCP SDK without protocol validation, hostname verification, or whitelisting. Attackers also control all HTTP headers, enabling header injection attacks. - Impact: An unauthenticated remote attacker can cause the Chainlit server to make arbitrary outbound HTTP requests to internal network hosts, forge HTTP headers, and probe cloud instance metadata services. Remediation SPL-2026-001 (Critical) - Architectural Fix - The field has been completely removed from client requests. The stdio MCP server is now defined exclusively in the server-side configuration. - Before Fix (v2.11.x, Vulnerable): - After Fix (v2.12.0, Fixed): SPL-2026-002 (High) - Defense-in-Depth Improvements - User-provided SSE/HTTP connections now require explicit opt-in ( ) and URL whitelisting. - Additional Measures: - URL schemes are enforced to be strictly / . - URL whitelisting uses component-level comparison to prevent subdomain/user-info bypasses. - Path prefix matching is normalized to prevent sibling path bypasses (e.g., no longer matches whitelist entry ). - Dangerous HTTP headers ( , , , , etc.) are stripped before forwarding. - HTTP redirects are not followed, applying to both developer-configured ("named") servers and user-provided servers. Although the MCP Python SDK hardcodes , 's overrides this with . - Each outbound request is re-validated (not just the initial URL) against the same hook. - The final item closes a related vulnerability: the SSE transport retrieves the POST target from the server's own event; the SDK accepts any same-origin value, including those outside the whitelist in the path subtree. Recommended Configuration (Optional User Servers): Mitigations for Users Unable to Upgrade Immediately Disable MCP — Set in your configuration (this is the default). This completely prevents exploitation of both vulnerabilities. Restrict Network Access — Place the Chainlit server behind a firewall to prevent outbound connections to the internal network and cloud metadata endpoints. Enable Authentication — Configure , , or OAuth so that the endpoint requires a valid user session. Anonymous access significantly lowers the barrier for exploitation. Timeline 2026-04-08: Report received from SPL Security 2026-04-08: Maintainers confirm vulnerability 2026-04-xx: Fix merged (this PR) 2026-xx-xx: v2.12.0 release 2026-xx-xx: Security advisory published

Goal Reached Thanks to every supporter — we hit 100%!

Chainlit MCP Command Injection & SSRF Vulnerabilities (SPL-2026-001/002)

More from this source