This vulnerability stems from Chainlit allowing the POST /mcp endpoint to be invoked without authentication when the feature is enabled. The endpoint accepts a user‑controlled URL and optional headers without validating the scheme, filtering private addresses, or enforcing an allowlist. As a result, an attacker can trigger blind outbound HTTP requests to arbitrary internal or external services, including cloud metadata endpoints, with attacker‑supplied Authorization and Cookie headers. The Chainlit server consumes the responses internally, but the attacker can issue state‑changing requests to internal infrastructure, discover services, scan ports, and probe metadata endpoints. The weakness is a classic Server Side Request Forgery (SSE) flaw identified in CWE‑918. The impact is the ability to access internal resources and perform unauthorized actions, potentially compromising sensitive data or services.

The affected product is the Chainlit framework. Any deployment across versions from 2.4.0rc0 up to, but not including, 2.12.0 that has the features.mcp.enabled flag set to true in the .chainlit/config.toml is vulnerable. Older or newer releases are not affected.

The CVSS score of 7.2 indicates a medium‑to‑high severity. The EPSS score is unavailable, but the lack of an authentication mechanism on the vulnerable endpoint lowers the barrier to exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits as of the data provided. An attacker can simply issue a crafted POST /mcp request to the Chainlit server, and, if the server is reachable from an attacker’s network, the SSRF will allow intranet or cloud endpoint enumeration and potentially state‑changing operations. The attack vector is simple and requires no privileged access to the target system.