Evidence · DiggingBeagle record
Advisory: Chainlit MCP allowed URL prefix bypass through semicolon normalization
Chainlit checked a path-scoped MCP URL allowlist before downstream servers normalized semicolon-separated URL path parameters, allowing a traversal-like segment to pass one representation and reach another path. CVE-2026-120492 demonstrates path-policy bypass on the same approved origin under particular backend parsing semantics. It does not demonstrate an arbitrary-host connection or confirmed credential theft. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
Chainlit checked a path-scoped MCP URL allowlist before downstream servers normalized semicolon-separated URL path parameters, allowing a traversal-like segment to pass one representation and reach another path. CVE-2026-120492 demonstrates path-policy bypass on the same approved origin under particular backend parsing semantics. It does not demonstrate an arbitrary-host connection or confirmed credential theft. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsChainlit MCP URL policy was bypassed through semicolon path normalization: CVE-2026-120492 demonstrates path-policy bypass on the same approved origin under particular backend parsing semantics. It does not demonstrate an arbitrary-host connection or confirmed credential theft.
GHSA-xhx7-9vjr-p2h8; validate_mcp_url and semicolon paths
- supportsChainlit MCP URL policy was bypassed through semicolon path normalization: Chainlit checked a path-scoped MCP URL allowlist before downstream servers normalized semicolon-separated URL path parameters, allowing a traversal-like segment to pass one representation and reach another path.
GHSA-xhx7-9vjr-p2h8; validate_mcp_url and semicolon paths