CVE-2026-22219
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Description
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.
INFO
Published Date :
Jan. 20, 2026, 12:15 a.m.
Last Modified :
Feb. 2, 2026, 8:56 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Chainlit to version 2.9.4 or newer.
- Review and secure the SQLAlchemy data layer configuration.
- Validate all user-supplied URLs before making outbound requests.
- Implement network segmentation and access controls.
Public PoC/Exploit Available at Github
CVE-2026-22219 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-22219.
| URL | Resource |
|---|---|
| https://github.com/Chainlit/chainlit/releases/tag/2.9.4 | Product Release Notes |
| https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element | Third Party Advisory |
| https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover | Exploit Mitigation Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-22219 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-22219
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
AI Security Newsletter - A monthly digest of AI security research, insights, reports, upcoming events, and tools & resources
ai artifical-intelligense cybersecurity newsletter security
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-22219 vulnerability anywhere in the article.
-
CybersecurityNews
Critical Chainlit AI Vulnerabilities Let Hackers Gain Control Over Cloud Environments
Cybersecurity researchers have uncovered two critical security flaws in Chainlit, a widely used open-source AI framework with over 700,000 monthly downloads. The vulnerabilities allow attackers to ste ... Read more
-
BleepingComputer
Chainlit AI framework bugs let hackers breach cloud environments
Two high-severity vulnerabilities in Chainlit, a popular open-source framework for building conversational AI applications, allow reading any file on the server and leaking sensitive information. The ... Read more
-
The Hacker News
Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs
Security vulnerabilities were uncovered in the popular open-source artificial intelligence (AI) framework Chainlit that could allow attackers to steal sensitive data, which may allow for lateral movem ... Read more
-
The Register
AI framework flaws put enterprise clouds at risk of takeover
Two "easy-to-exploit" vulnerabilities in the popular open-source AI framework Chainlit put major enterprises' cloud environments at risk of leaking data or even full takeover, according to cyber-threa ... Read more
The following table lists the changes that have been made to the
CVE-2026-22219 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Feb. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:chainlit:chainlit:*:*:*:*:*:*:*:* versions up to (excluding) 2.9.4 Added Reference Type VulnCheck: https://github.com/Chainlit/chainlit/releases/tag/2.9.4 Types: Product, Release Notes Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element Types: Third Party Advisory Added Reference Type VulnCheck: https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover Types: Exploit, Mitigation, Third Party Advisory -
CVE Modified by [email protected]
Jan. 20, 2026
Action Type Old Value New Value Added Reference https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover -
New CVE Received by [email protected]
Jan. 20, 2026
Action Type Old Value New Value Added Description Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-918 Added Reference https://github.com/Chainlit/chainlit/releases/tag/2.9.4 Added Reference https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element