Loading story…
Chainlit released version 2.12.0 to remediate two unauthenticated vulnerabilities in its Model Context Protocol /mcp endpoint: critical command injection/RCE, CVE-2026-45018 (CVSS 9.8), and high-severity SSRF, CVE-2026-45019 (CVSS 7.2). Versions 2.4.0rc0 through 2.11.x are affected when features.mcp.enabled = true. The command-injection issue allowed attackers to submit client-controlled stdio fullCommand values; configurations with no allowed_executables restriction could allow arbitrary commands through permitted tooling such as npx -c, executing under the Chainlit process account.
The SSRF issue let attackers supply arbitrary HTTP/SSE MCP URLs and headers, enabling requests to loopback and private-network services, Docker sockets, Kubernetes APIs, databases, and cloud metadata endpoints such as 169.254.169.254, with possible exposure of temporary cloud credentials. Version 2.12.0 requires server-side named configuration for stdio MCP servers and adds explicit opt-in allowlisting, destination revalidation, sensitive-header filtering, and redirect blocking for user-provided HTTP/SSE connections. Organizations should upgrade promptly; where that is not immediately possible, disable MCP with features.mcp.enabled = false, enforce authentication, and block server egress to internal networks and cloud-metadata services.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
SPL Security reported and Chainlit confirmed two MCP `/mcp` endpoint vulnerabilities: critical command injection/RCE (SPL-2026-001/CVE-2026-45018) and high-severity SSRF (SPL-2026-002/CVE-2026-45019). The researchers supplied working proof-of-concept exploits.
CVE-2026-45018's stdio command validation allowed arbitrary host binaries when `features.mcp.stdio.allowed_executables` was unset, and validated only the executable basename while leaving arguments unchecked. Even configured allowlists could be bypassed with dual-use executables such as `npx` using `-c` or `--call` to run attacker-supplied commands.
Chainlit released version 2.12.0 to address unauthenticated command injection in the stdio MCP transport and SSRF in SSE and streamable-HTTP MCP connections affecting versions 2.4.0rc0 through 2.11.x when MCP was enabled. The release removes client-controlled stdio commands, requires server-defined named MCP servers, and adds opt-in URL allowlisting, header filtering, redirect blocking, and destination revalidation for user-provided MCP connections.
Chainlit disabled its Model Context Protocol (MCP) functionality by default beginning with version 2.7.0, limiting exposure to deployments that explicitly enabled `features.mcp.enabled`.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed vulnerabilities affect widely used security and AI-adjacent platforms. **Chainlit** versions earlier than `2.10.1` are vulnerable to **CVE-2026-56104**, a critical flaw in WebSocket session restoration that lets an unauthenticated attacker supply a valid `sessionId` and inherit an authenticated user’s session without ownership verification. The issue can allow attackers to assume victim roles and permissions, invoke tools without authorization, and access data available only to the compromised user. The published guidance is to upgrade to **Chainlit 2.10.1 or later** and ensure session restoration enforces ownership checks. **OpenCTI** is also affected by **CVE-2026-21887**, a server-side request forgery vulnerability in its data ingestion component that allows an authenticated attacker to force the platform to fetch attacker-controlled URLs. Because OpenCTI often runs as a trusted internal node in security operations environments, the flaw can be used to reach internal services, bypass perimeter controls, and in cloud deployments query the instance metadata service at `169.254.169.254` to obtain temporary AWS IAM credentials, potentially enabling broader infrastructure compromise. The issue was scored **CVSS 7.7**, and remediation centers on validating outbound destinations and blocking requests to private and link-local address ranges.
Jun 29, 2026
Security researchers reported two **high-severity vulnerabilities** in the open-source AI chatbot framework **Chainlit** that could enable sensitive data exposure and, in some environments, broader cloud compromise. The issues—**CVE-2026-22218** (arbitrary file read) and **CVE-2026-22219** (server-side request forgery, SSRF)—were described as “easy-to-exploit” and particularly risky because Chainlit-based applications are often deployed internet-facing and integrated with other enterprise services (for example, via common AI tooling and cloud backends). Technical details indicate CVE-2026-22218 can be triggered via a malicious element update request using a tampered custom element, allowing attackers to read files such as `/proc/self/environ` and potentially exfiltrate environment variables containing **API keys, credentials, and other secrets**. CVE-2026-22219 could allow SSRF against servers hosting AI applications, creating a path to access internal resources. Zafran reported responsible disclosure to maintainers in November and stated it had not observed in-the-wild exploitation; Chainlit released **version 2.9.4** to address both flaws, and organizations running Chainlit were advised to update to the patched release.
Jun 29, 2026
Anthropic fixed three vulnerabilities in its official *Git MCP server* (`mcp-server-git`) that could be triggered via **prompt injection** and chained with other MCP tools to achieve **remote code execution** or destructive file operations. The issues were reported by agentic AI security firm **Cyata**, which demonstrated that attacker-controlled content an AI assistant might read (for example, a malicious `README`, poisoned issue text, or other untrusted context) could drive the LLM to invoke MCP tool calls with crafted arguments, enabling exploitation without the attacker having direct access to the victim host. Cyata identified `CVE-2025-68143` (**unrestricted `git_init`**), `CVE-2025-68145` (**path validation bypass**), and `CVE-2025-68144` (**argument injection in `git_diff`**). In combination—particularly when `mcp-server-git` is used alongside the *Filesystem MCP server*—the flaws could enable code execution, arbitrary file deletion/overwrite, and reading arbitrary files into the LLM context (with Cyata noting this does not inherently provide direct exfiltration). The vulnerabilities affected default deployments of `mcp-server-git` prior to **version `2025.12.18`**; Anthropic was notified in June and shipped fixes in December, and there was no indication reported that the bugs were exploited in the wild.
Jun 29, 2026