CVE-2026-56104highCWE-862

CVE-2026-56104: falha de alta gravidade em chainlit

Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar chainlit+ Monitorar chainlit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.4%
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
Chainlit · chainlit
CVEs relacionadas — chainlit

No mesmo produto, das mais perigosas para as menos.

CVE-2026-45018CRITICALChainlit: Command injection via MCP stdio transport allows unauthenticated remote code executionEPSS 1.1%CVE-2026-86099HIGHChainlit through 2.12.0 Path Traversal via socket.io sessionIdEPSS 0.6%CVE-2026-45019HIGHChainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network accessEPSS 0.4%CVE-2026-82290MEDIUMChainlit Feedback Endpoints Missing Ownership ValidationEPSS 0.3%