al-ice.ai

The Allowlist Has a Semicolon Problem: Chainlit CVE-2026-120492 Bypasses MCP URL Grants

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 2 November 2026, VulnCheck disclosed CVE-2026-120492, a server-side request forgery flaw in Chainlit 2.12.0 — the conversational-AI framework teams use to ship chat front ends over their agents. The validate_mcp_url validator does not reject the semicolon character, so an unauthenticated attacker can submit MCP URLs with ..; segments to the /mcp endpoint and reach paths outside the operator’s grant on origins that strip semicolon path parameters. NVD scores it CVSS 3.1 5.4 Medium (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) and CVSS 4.0 6.3 Medium, CWE-918. The sting is in the version number: 2.12.0 is the current PyPI release — there is no fixed release to upgrade to yet.

A bypass of the fix, not a first bug

Chainlit 2.12.0 was itself the allowlist release. In August 2026, the project shipped 2.12.0 to fix CVE-2026-45019 (CVSS 7.2 High): an unauthenticated SSRF in which the /mcp endpoint accepted a user-controlled URL plus attacker-controlled headers with no validation at all, fixed by an opt-in, allowlist-based model requiring features.mcp.user_servers.enabled = true plus a non-empty allowed_urls list, with deny-all default. CVE-2026-120492 breaks that new allowlist at its path-matching layer: a path-scoped grant the operator believed was fenced can be walked out of with semicolon segments. The NVD record carries the unsupported-when-assigned tag, and the maintenance backdrop is worth stating plainly: Chainlit’s own PyPI project description says the framework is community-maintained since 1 May 2025, after the original team stepped back. Allowlist logic in a community-maintained parser is exactly where single-character validation gaps survive — the same pattern family as the Network-AI path traversals and the Prefab UI sandbox escape, where boundary code, not model behavior, was the hole.

Scope and what to actually do

Exposure requires the MCP surface to be reachable with user-provided servers behind path-scoped allowed_urls — the deployments that did the right thing in August and adopted the allowlist model. Two scoping facts from the August advisory cut the other way for most fleets: MCP has been disabled by default since v2.7.0, and the /mcp anonymous path exists where no auth callback is registered. If you run Chainlit 2.12.0 with MCP user servers enabled: treat every path-scoped grant as porous until a patched release lands — narrow allowed_urls to the minimum viable set, and apply the August advisory’s own hardening in the meantime (disable features.mcp.enabled where MCP is unused, restrict outbound egress toward internal ranges and metadata endpoints, and put an auth callback in front of /mcp so the anonymous path closes). This is the second Chainlit SSRF lineage we have tracked after February’s ChainLeak cloud-takeover bugs, and it belongs in the same remediation queue as the Langflow auto-login plus MCP RCE pair: agent frameworks whose HTTP surfaces predate their agent threat models.

Our verification was read-only. We read the full NVD JSON record for CVE-2026-120492 first-hand (published 2 November 2026, VulnCheck source: semicolon mechanism, ..; segments, /mcp endpoint, both CVSS vectors, CWE-918, 2.12.0 affected, Deferred status, unsupported-when-assigned tag, code and advisory references), the VulnCheck advisory page first-hand (CWE-918 confirmation, GHSA and code-link references), the August GHSA-hvfh-5mj3-5f3j advisory first-hand via the GitHub API (CVE-2026-45019 context: affected ranges, 2.12.0 allowlist fix, disabled-by-default-since-2.7.0, workarounds — cited for context only), and the PyPI JSON API first-hand (latest release 2.12.0, community-maintained notice). The August GHSA page is cited via the NVD references. The ChainLeak, Langflow, Network-AI and Prefab parallels are our prior coverage linked above. We ran no Chainlit instance, crafted no traversal, scanned nothing, and contacted no one. Brave Search was used for discovery only.

Sources: