Chainlit MCP URL policy was bypassed through semicolon path normalization

Chainlit checked a path-scoped MCP URL allowlist before downstream servers normalized semicolon-separated URL path parameters, allowing a traversal-like segment to pass one representation and reach another path.

CVE-2026-120492 demonstrates path-policy bypass on the same approved origin under particular backend parsing semantics. It does not demonstrate an arbitrary-host connection or confirmed credential theft.

This is a mismatch between a policy parser and the eventual HTTP recipient. Chainlit evaluates a configured path prefix as written, while another server can interpret a semicolon as a path-parameter separator and remove the surrounding traversal-like component. Under those parsing rules, the destination can be a different protected path on the same host even though the URL passed the allowlist. The reported configuration involves path-scoped MCP allowed_urls; it is not evidence of arbitrary-domain SSRF. Defenders must compare the effective URL accepted by the backend with the route the policy authorized, or enforce authorization again inside the receiving service.

An allowlist comparison has to apply to the destination the recipient will actually interpret. A semicolon-bearing path can remain inside the apparent prefix for one parser, then resolve outside it when a downstream server treats a segment as a parameter. This is a path-scope failure on an otherwise allowed host, not proof that an arbitrary external hostname can be contacted. A regression should test both the validation representation and the backend's resolved route; checking only the original URL string repeats the vulnerable assumption.