Chainlit MCP stdio unauthenticated RCE
Direct answer
Chainlit MCP stdio unauthenticated RCE, also tracked as CVE-2026-45018 is a critical-severity threat campaign HOL Guard tracked from Aug 25, 2026 to Aug 25, 2026, verified against 4 primary sources and last reviewed Sep 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Chainlit versions from 2.4.0rc0 through 2.11.1 are affected by CVE-2026-45018 when features.mcp.enabled is true. The stdio MCP path can allow unauthenticated remote command execution. Chainlit rates the issue Critical at CVSS 9.8 and identifies 2.12.0 as the fixed release in the advisory details.
Also tracked as CVE-2026-45018
- First observed
- Aug 25, 2026
- Last observed
- Aug 25, 2026
- Last reviewed
- Sep 22, 2026
- Tracking ended
- Aug 25, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
The advisory page's package metadata currently shows no patched version while its detailed affected/patched table and Fix section identify 2.12.0. This record follows the detailed advisory text and keeps that page-level inconsistency explicit.
- Campaign tracks CVE-2026-45018. CVE-2026-45019 is a separate companion issue and is not an alias for this record.
- The issue applies when features.mcp.enabled is true. Chainlit says MCP has been disabled by default since v2.7.0.
- The Chainlit advisory rates CVE-2026-45018 Critical at CVSS 3.1 score 9.8.
- The advisory's detailed affected/patched table and Fix section identify 2.12.0 as the corrected release, although the page's package metadata still displays Patched versions: None.
- HOL blog is operator guidance.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CVE-2026-45018 Chainlit MCP stdio unauthenticated RCE disclosed.
- Vendor action
Chainlit's advisory details identify version 2.12.0 as the fixed release for CVE-2026-45018 and rate the issue Critical at CVSS 9.8.
Source:Chainlit GHSA-w3fx-mc44-mf6j
Publication clock: 672.6 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Chainlit versions from 0rc0 through HOL Guard tracked the campaign from Aug 25, 2026 to Aug 25, 2026.
No. Active tracking ended Aug 25, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 4 primary sources, names 0 reviewed artifacts, and was last fully reviewed Sep 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The advisory page's package metadata currently shows no patched version while its detailed affected/patched table and Fix section identify 2.12.0.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-F07169FB