Chainlit enthält eine Server-Side Request Forgery (SSRF) Schwachstelle

The SSRF vulnerability allows an attacker to initiate arbitrary HTTP requests from the Chainlit server. This can be leveraged to access internal network services, cloud metadata endpoints, or any other resource accessible to the server. The attacker can then store the retrieved responses via the configured storage provider, potentially exfiltrating sensitive data such as API keys, database credentials, or internal configuration information. This vulnerability is particularly concerning as it bypasses standard network security controls, allowing access to resources that should be isolated from external requests. The SQLAlchemy backend's reliance on user-supplied URLs without proper validation is the root cause of this issue.

Organizations deploying Chainlit with the SQLAlchemy data layer backend are at risk. This includes those using Chainlit for internal tool development, chatbot applications, or any scenario where user-supplied URLs are processed by the server. Shared hosting environments where Chainlit instances share resources are particularly vulnerable.

• python / server:

import requests
import urllib.parse

def check_ssrf(url):
    try:
        parsed_url = urllib.parse.urlparse(url)
        if parsed_url.scheme in ('http', 'https'):
            # Basic check - more sophisticated validation needed
            response = requests.get(url, timeout=5)
            print(f"URL {url} accessible. Status code: {response.status_code}")
        else:
            print(f"Invalid URL scheme: {url}")
    except requests.exceptions.RequestException as e:
        print(f"Error accessing {url}: {e}")

# Example usage - replace with actual URL from logs
check_ssrf('http://169.254.169.254/latest/meta-data/iam/security-credentials/admin')

• generic web:

curl -I 'http://your-chainlit-instance/project/element?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin' | grep HTTP/1.1

1. 2026-01-20Disclosure

   disclosure

2. 2026-01-20Patch

   patch

1. Reserviert2026-01-06
2. Veröffentlicht2026-01-20
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22219 is to upgrade Chainlit to version 2.9.4 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound HTTP requests and block suspicious URLs. Specifically, block requests to known metadata endpoints or internal IP ranges. Additionally, review and restrict the permissions of the Chainlit service account to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to trigger the element update flow with a known malicious URL and verifying that the request is blocked or handled safely.