If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-45019 - Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access

CVE ID : CVE-2026-45019 Published : Aug. 25, 2026, 8:16 p. m. • 55 minutes ago Description : Chainlit is a Python framework for building production-ready conversational AI applications. From 2. 4. 0rc0 until 2. 12. 0, Chainlit deployments with features. mcp. enabled set to true in . chainlit/config. toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types. py accept a user-controlled url and optional headers dictionary without scheme validation, private-address filtering, or an allowlist. The connect_mcp handler in backend/chainlit/server.

·CVEFeed
Read →

You've reached the end of current stories for this search.