CVE-2026-120492

Chainlit MCP path allowlists can disagree with origin normalization

Chainlit · User-provided MCP HTTP connections

First documented disclosure · Review checkpoint

Summary

A semicolon path can escape an allowed URL subtree on the same origin.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 4.0. Severity source.

Exploitation not established: CNA technical disclosure; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

URL validation accepts parent-like segments containing semicolons; a downstream origin that strips path parameters can resolve them differently.

Conditions required

MCP and user-provided servers enabled, a path-scoped allowed_urls grant and a semicolon-normalizing destination. Anonymous access applies where application authentication is not configured.

Potential impact

Server-side requests outside the permitted path. This is not demonstrated access to arbitrary other origins or a confirmed data theft.

Affected versions and configurations

2.12.0 according to VulnCheck.

Fix and mitigation status

No issue-specific fixed release verified.

Practical next steps

Disable user-provided MCP connections or restrict them to dedicated origins and enforce destination access controls until a verified fix is available.

Operating lesson

A path authorization check must match how the destination interprets that path.

Evidence and limits

The referenced GHSA-hvfh-5mj3-5f3j is CVE-2026-45019, fixed by 2.12.0. Its August date and fix do not apply to this new semicolon bypass. November 2 is the verified disclosure; reviewed current source and releases establish no superseding fix.

Sources