CVE-2026-45018

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

PT-2026-81486

Name of the Vulnerable Software and Affected Versions Chainlit versions 2.4.0rc0 through 2.11.9 Description Deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the 'POST /mcp' endpoint without authentication. For stdio transport, the endpoint accepts a user-controlle...