Chainlit's MCP endpoint gives unauthenticated RCE, because the allowlist checks the executable and ignores the arguments.

CVE-2026-45018 covers Chainlit >=2.4.0rc0 <2.12.0. With features.mcp.enabled = true, POST /mcp accepts a user-controlled fullCommand for stdio transport. validate_mcp_command() checks the executable name against an allowlist and never inspects arguments, so npx -y -c '<command>' executes as the server process with no authentication (GitHub Advisory). The companion CVE-2026-45019 is SSRF through the same endpoint's sse and streamable-http transports, which accept an arbitrary url plus attacker-controlled Authorization and Cookie headers. MCP has been off by default since v2.7.0, which is the only thing limiting the blast radius.