Zafran's ChainLeak research found Chainlit issues enabling arbitrary file read, cross-user prompt and response cache exposure, and server-side request forgery through element handling. Because the affected code is framework plumbing sitting next to prompts, uploaded files and application configuration, arbitrary file access can reveal prompt caches, responses, environment variables, API keys, internal paths and deployment metadata. The SSRF path turns element URL fetching into reach toward internal services, cloud metadata endpoints and cloud control-plane targets where no safe-fetch policy exists. Chained, leaked environment secrets and internal endpoint data enable credential reuse, lateral movement and cloud resource access — the researchers' 'cloud takeover' framing. Remediation requires both upgrading Chainlit and adding deployment controls: strict parameter validation, per-user and per-tenant object authorization, safe fetch, secret storage and egress monitoring.
ASSESSED SYSTEM
A representative internet-facing LLM chat/agent application built on an affected, pre-patch version of Chainlit, in the state Zafran's ChainLeak research documented: element-handling helper APIs and data-layer endpoints reachable without per-user, per-tenant object authorization, no path validation on element/file parameters, no safe-fetch policy on element URL retrieval, and API keys and cloud credentials held in environment files on the application host. Representative rather than named: the research is framework-level and the brief directs operators to find their own internet-facing Chainlit applications; no victim organisation is identified.
OUT OF SCOPE
Patched Chainlit releases and applications that already enforce object-level authorization, path validation, safe fetch and secret-store credentials; the underlying LLM and model provider; the cloud provider's metadata service and IAM configuration; and any specific organisation's Chainlit deployment.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q1 NO and Q2 NO — no agent topology, planner loop or autonomous multi-step workflow is evidenced for the assessed configuration; Chainlit is described as a framework for building LLM chat and agent apps, and only the chat/element surface is evidenced here. Q3 YES — the application's server-side helper APIs perform outbound URL fetches on behalf of the session (the SSRF path) and read and write a persistent data layer holding prompt and response caches and uploaded elements; Q3 explicitly covers connectors, databases and browsers 'even if execution is user-triggered or single-step'. Evidence artefacts: the element URL-fetch path, the element/file/cache and data-layer APIs the brief tells operators to test for object authorization, and the uploaded-element store. Deployments of Chainlit that host agent apps would classify higher under the hybrid rule. Tier 2: Tier 2 Consumer — the assessed configuration is an internet-facing chat application in direct interaction with individual users, and the realised harm (cross-user prompt and response cache exposure) affects those individuals' data directly; internal-only Chainlit deployments behind authentication would be Tier 3.
Documented attack or failure path
- Attacker interacts with an internet-facing application built on an affected Chainlit version.
- Crafted element identifiers, file paths or filters are submitted to element and data-layer helper APIs that apply no strict schema or bounds validation.
- Arbitrary file read returns prompt caches, stored responses, environment variables containing API keys, internal paths and deployment metadata.
- Missing per-user and per-tenant object authorization on the same APIs exposes other users' prompt and response caches and uploaded elements.
- Element URL fetching is abused as SSRF, with no allowlist, private-IP block, redirect or DNS-rebinding check, to reach internal services and the cloud metadata endpoint.
- Recovered long-lived cloud keys and internal endpoint knowledge are reused for lateral movement and cloud resource access.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Patched Chainlit releases are available and the issues were disclosed through coordinated advisories, giving operators a concrete upgrade target rather than an open-ended architectural problem.
- The response guidance recommends searching web and egress records for suspicious paths and destinations. It does not prove those records existed in the assessed deployment, so it receives no positive scoring credit.
- The exposure is bounded by deployment choices the operator controls — applications already using short-lived workload identities and a secret store instead of environment files, or an egress-controlled network, do not hand the file-read and SSRF paths a credential to steal.
- The affected surface is framework plumbing rather than the model or its safety behaviour, so remediation does not depend on model changes and no model-side property had to be relied upon.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.25 | Pr-3 0.25: minimisation controls do not cover the retained prompt/response cache or the credential material co-located with it; unnecessary sensitive fields persist on paths that a single validation failure exposes. | The application retained prompt and response caches and uploaded files in locations reachable from unvalidated helper APIs, and held API keys and cloud credentials in environment files on the same host — the remediation is to 'move API keys and cloud credentials out of environment files where possible; prefer short-lived workload identities and secret stores'. Arbitrary file read therefore yielded not only user prompts and responses but also environment variables, internal paths and deployment metadata from a single application host.source: researcher |
| Containment (Cn) — scenario interval 0.04–0.72 (midpoint 0.38), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.16 | Cn-1 0.00: no effective scope boundary — the system can reach unauthorised data and unauthorised network destinations from ordinary request parameters. | Two boundaries were absent simultaneously. On the filesystem, element/file parameters produced arbitrary file read — no path canonicalisation or bounds check confined the application to its own data. On the network, element URL fetching reached internal services, metadata endpoints and cloud control-plane targets because no safe-fetch policy, private-IP block, allowlist or redirect check existed.source: researcher |
| Cn-2Escalation Prevention | 0.25w 0.16 | Cn-2 0.25: basic role/session checks exist but are defeated by object-level role confusion, letting a caller reach data outside its authorised role. Taken as the lower of the plausible band because the evidence does not establish how strong the surrounding session authentication was. | Cross-user prompt and response cache exposure means the session boundary existed but object-level authorization did not: a caller legitimately holding one session reached objects belonging to other users. The direct remediation, AID-H-029.002 (Very High), is to ensure 'prompt caches, user files, uploaded elements, and generated artifacts are authorized per user, tenant, and object before access', and operators are told to test element, file, cache and data-layer APIs for exactly that.source: researcher |
Unknown, not N/A: 20 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | Human-on-the-loop: the application performs routine server-side actions autonomously within pre-defined boundaries — element URL fetches, cache reads and writes, data-layer persistence — with no per-action human approval, and its generated output is consumed by a human user. It executes no consequential external transactions and holds no independent decision authority, so it sits well below the supervised-autonomy anchor. |
| AsAttack Surface Exposure | 0.75w 0.35 | Matches the 0.75 anchor: an internet-facing application ingesting external, untrusted content via user prompts, uploaded files and user-supplied element URLs that it fetches server-side. It is not raised to 1.00 because no multi-agent communication, external agent channel or MCP tool integration is evidenced for the assessed configuration. Noted explicitly: 0.75 sits on the CRM elevated boundary but is not counted as elevated, since N_elevated counts dimensions scoring strictly above 0.75. |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph is published for any affected deployment, so the spec's DGC < 0.90 rule applies; the reconstruction independently triggers the 1.00 anchor. Two ungated paths from an entry-exposed origin reach credential-issuing (P4) capability: arbitrary file read of environment files containing long-lived cloud keys, and SSRF to the cloud metadata endpoint, which mints credentials by design. The researchers' documented escalation from application data to cloud takeover is the same path traced end to end.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Deterministic upstream fixes exist — upgrade Chainlit to the patched versions — which alone would argue for 0.00. Scored 0.25 because the brief is explicit that 'these bugs require both patching and deployment controls': strict parameter validation, object authorization, SSRF-safe fetch wrappers with private-IP, metadata, redirect and DNS-rebinding checks, moving credentials into a secret store or short-lived workload identity, and egress monitoring — deployment-infrastructure work measured in days, plus rotation of any credential the file-read or SSRF path could have reached. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal provenance record: the framework, the vendor and the affected component surface are identified through published advisories, but nothing about a representative deployment's model, prompt lineage, data-layer contents, corpus, tool inventory or identity policy is documented — and the incident itself shows that per-object ownership of the persisted prompt and response cache was not tracked in a reviewable way. |
| Ec — Public evaluation coverage | 0.12 | coverage 0.13 (3 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.01 | Evidence dated 2026-01-20; age 205 days on the workpaper reference date. Components: T_behavior 0.01 · T_containment 0.04 · T_calendar 0.21 · C_event 0.35 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. dt_days = 205, measured from the primary disclosure (Zafran, 2026-01-20) to the assessment date 2026-08-13. This is the load-bearing difference between this case and the rest of the batch: the AIDEFEND brief republished the analysis on 2026-07-06, but republication is not new evidence, and the underlying research is more than six months old. agentic = true: a Tool-Calling / Connected GenAI application whose outbound fetch and data-layer permission boundaries are runtime-mutable, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item one — cross-session persistent state written from model output: the data layer persists prompts and responses and re-loads them into resumed conversations, which is the very cache the incident exposed. With no Behavioral Attestation Battery in evidence, the behavioural floor T_behavior binds hard at this elapsed time, and the resulting ACI should be read as the spec intends — evidence this old about a stateful consumer-facing system cannot support an assurance claim and calls for reassessment, not for treating the number as precise risk. C_event = 0.35 (major): a critical file-read and SSRF disclosure with credential exposure, and the patched releases have since superseded the assessed configuration. C_monitor = 0.65: no detection of cross-user cache access or metadata-endpoint requests is reported; the prescribed action is retrospective log hunting. C_evidence = 0.85: unresolved credential gap — long-lived keys held in environment files remain valid until rotated. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.06 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-029.002 | Lifecycle-Stage Authorization GateParent AID-H-029 (AI Data-Use Authorization & Lifecycle-Stage Boundary Enforcement), dataVersion 2026.08.05. Authorizing prompt caches, user files, uploaded elements and generated artefacts per user, tenant and object before access is the missing control behind Cn-2 = 0.25 and the retained-cache half of Pr-3 = 0.25. | Very High | Pr-1 Pr-3 Pr-4 |
| AID-H-019.001 | URL Normalization & Allowlist FilteringParent AID-H-019 maps directly to Ro-1, Cn-1, and Cn-3 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. Recorded because it is the direct SSRF control for element URL fetching — blocking private IPs, metadata services, unsafe redirects and non-approved destinations — and its absence is half of the Cn-1 = 0.00 finding. | Very High | Cn-1 Cn-3 Ro-1 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationParent AID-H-002 (AI-Contextualized Data Sanitization & Input Validation), dataVersion 2026.08.05. The catalogue maps this parent to Fa-1, Fa-3 and Ro-1; in this case its operational relevance is strict schema and bounds validation on element IDs, file paths and filters, which is the other half of the Cn-1 = 0.00 finding. No Cn-1 mapping is asserted beyond the lookup, and no Fairness or Ro-1 score is claimed, since the incident produces no evidence about model-level adversarial behaviour. | High | Fa-1 Fa-3 Ro-1 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.08.05. Reconciling deployed Chainlit versions against the file-read and SSRF advisories and verifying by runtime readback that no vulnerable digest remains is the evidence behind the patch half of Rf = 0.25. | High | Ro-4 Tr-4 |
| AID-I-002.002 | Secure External AI Service ConnectivityParent AID-I-002 (Network Segmentation & Isolation for AI Systems), dataVersion 2026.08.05. Egress controls constrain what the application can call even when an SSRF path is reachable, which is what would break the metadata-endpoint leg of the corroborated Cp path. | High | Cn-4 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.08.05. Revoking or rotating the exact cloud access keys, API keys, client secrets and long-lived certificates exposed by file read or SSRF is what would lift the C_evidence = 0.85 cap. | High | Cn-5 |
| AID-E-004 | Incident Exploit-Path Closure VerificationAID-E-004 is absent from the reconciled AIDEFEND-to-AITBM lookup at dataVersion 2026.08.05; no AITBM sub-metric mapping is asserted for it. Recorded because independently replaying the exact file-read and SSRF requests against the affected population is the closure evidence the assessment lacks. | High | ACI:C_event recovery ACI:containment/behavioral re-attestation |
WHAT THIS CASE TEACHES
Two AITBM behaviours meet in this case: As sitting exactly on 0.75 keeps N_elevated at one and CRM at 1.00 even though the cascade path is corroborated all the way to a credential-issuing node, and 191-day-old evidence about a stateful consumer-facing app drives the behavioural freshness floor low enough that the honest conclusion is 'reassess', not 'here is a precise score'.
Sources: AIDEFEND in Action brief — ChainLeak Shows How AI Framework Helper APIs Can Expose Prompts, Files, and Cloud Keys (2026-07-06) · Zafran Labs — ChainLeak: Critical AI Framework Vulnerabilities Expose Data, Enable Cloud Takeover, Gal Zaban & Ido Shani (2026-01-20)