Chainlit's MCP endpoint gives unauthenticated RCE when enabled, because the allowlist checks the executable and ignores the arguments

GitHub Advisory Database·high signalXBlueskyLinkedInCopy link

CVE-2026-45018 (GHSA-w3fx-mc44-mf6j, critical, 25 Aug) covers Chainlit >=2.4.0rc0 <2.12.0: with `features.mcp.enabled = true`, `POST /mcp` accepts a user-controlled `fullCommand` for stdio transport, and `validate_mcp_command()` checks the executable name against an allowlist but never inspects arguments, so `npx -y -c '<command>'` executes as the server process with no authentication. The companion CVE-2026-45019 (high) is SSRF through the same endpoint's sse and streamable-http transports, which accept an arbitrary `url` plus attacker-controlled `Authorization` and `Cookie` headers. MCP has been off by default since v2.7.0, which is the only thing limiting blast radius.