ChainLeak: AI Framework Vulnerabilities Enable Enterprise Cloud Takeovers

What Happened

Security researchers at Zafran Labs discovered two critical vulnerabilities in Chainlit, a popular Python framework for building conversational AI applications. The bugs were patched in version 2.9.4 on December 24, 2025, with CVE assignments on January 6, 2026.

CVE-2026-22218: Arbitrary File Read

Severity: Critical
CVSS Score: Not yet rated (estimated 8.5+)
Impact: Complete file system access on the server

How it works:

1. Attacker sends authenticated request to /project/element endpoint
2. Manipulates file path parameter to access arbitrary files
3. Reads sensitive files like:
   • /proc/self/environ - Environment variables containing AWS keys, secrets, database credentials
   • .chainlit/.langchain.db - User conversations and prompts
   • /etc/passwd, /etc/shadow - System files
   • .env files - Application secrets
4. Extracts CHAINLIT_AUTH_SECRET to forge authentication tokens for any user

Root cause: Insufficient input validation on file path parameters allowing directory traversal attacks.

CVE-2026-22219: Server-Side Request Forgery (SSRF)

Severity: Critical
CVSS Score: Not yet rated (estimated 9.0+)
Impact: AWS cloud credential theft and lateral movement

How it works:

1. Attacker exploits SQLAlchemy data layer in Chainlit
2. Forces server to make requests to attacker-controlled URLs
3. Targets AWS Instance Metadata Service (IMDSv1): http://169.254.169.254/latest/meta-data/iam/security-credentials/
4. Retrieves temporary IAM role credentials with full permissions
5. Uses stolen credentials to access:
   • S3 buckets (data exfiltration)
   • AWS Secrets Manager (additional credentials)
   • Bedrock/SageMaker (LLM access)
   • RDS databases

Root cause: Unvalidated URL parameters in database connection strings combined with AWS IMDSv1 still being enabled (doesn't require authentication).

Why AI Framework Security Matters

AI frameworks are the new high-value target. Here's why ChainLeak represents a broader security crisis:

1. Massive Attack Surface

• 700,000 monthly downloads from PyPI
• Used by enterprises in finance, energy, healthcare, academia
• Documented usage by NVIDIA (AI development) and Microsoft (Azure deployments)
• Internet-facing deployments confirmed by security scans

2. Direct Cloud Access

AI frameworks typically run with elevated privileges because they need to:

• Access LLM APIs (OpenAI, Anthropic, AWS Bedrock)
• Query vector databases (Pinecone, Weaviate)
• Read training data from cloud storage
• Store conversation history and logs

Problem: A single vulnerability = instant cloud access. No lateral movement needed.

3. Sensitive Data Exposure

Chainlit applications store:

• User conversations: Internal company discussions with AI
• Prompt injection attempts: Reveals business logic
• API keys: OpenAI, Anthropic, Google Cloud credentials
• Training data: Proprietary datasets

4. Supply Chain Implications

From Zafran Labs research:

• AI frameworks often run with IAM roles granting broad permissions
• Developers prioritize functionality over security (move fast, break things)
• Security teams don't yet have AI-specific testing methodologies
• Patch adoption is slow (organizations still running vulnerable versions)

The Cloud Credential Theft Kill Chain

Here's how an attacker weaponizes ChainLeak for enterprise takeover:

Phase 1: Initial Access (CVE-2026-22218)

1. Discover internet-facing Chainlit application (Shodan, Google dorks)
2. Create low-privilege account (often free tier or trial)
3. Send malicious PUT request to /project/element with path traversal: ../../../../proc/self/environ
4. Extract environment variables containing AWS keys and CHAINLIT_AUTH_SECRET

Phase 2: Privilege Escalation

1. Use stolen CHAINLIT_AUTH_SECRET to forge JWT tokens
2. Authenticate as admin user or service account
3. Access administrative endpoints

Phase 3: Cloud Takeover (CVE-2026-22219)

1. Exploit SSRF vulnerability to query AWS IMDS: http://169.254.169.254/latest/meta-data/iam/security-credentials/[role-name]
2. Retrieve temporary credentials (AccessKeyId, SecretAccessKey, SessionToken)
3. Use AWS CLI or SDK to authenticate with stolen credentials
4. Enumerate permissions: aws sts get-caller-identity

Phase 4: Lateral Movement

With AWS credentials, attacker can:

• S3 Buckets: Exfiltrate training data, customer information, logs
• Secrets Manager: Steal additional credentials (database passwords, API keys)
• RDS/DynamoDB: Access production databases
• Bedrock/SageMaker: Poison AI models, steal proprietary prompts
• EC2: Pivot to other servers via security groups
• Lambda: Execute arbitrary code in cloud functions

Total time to cloud takeover: Under 10 minutes for a skilled attacker.

How to Test AI Applications for ChainLeak-Style Vulnerabilities

If you're a bug bounty hunter or security tester, here's how to find similar vulnerabilities in AI frameworks:

Step 1: Identify AI Framework Usage

Detection methods:

• Check HTTP headers for framework signatures: X-Chainlit-Version, X-Powered-By
• Analyze JavaScript files for framework-specific code
• Look for characteristic endpoints:
  • Chainlit: /project/element, /project/settings
  • Streamlit: /_stcore/health
  • Gradio: /api/predict
• Use Wappalyzer browser extension to detect frameworks

Step 2: Test for Arbitrary File Read (CVE-2026-22218)

Target endpoints: Any endpoint accepting file paths, document names, or resource identifiers.

Test payloads:

PUT /project/element HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer [your-token]

{
  "path": "../../../../etc/passwd"
}

# Try these common targets:
# ../../../../proc/self/environ
# ../../../../.env
# ../../../../.chainlit/.langchain.db
# ../../../../app/config.py
# ../.aws/credentials

Success indicators:

• Response contains file contents (look for root:x:0:0 in /etc/passwd)
• Different error messages for existing vs non-existing files
• File size in response headers

Step 3: Test for SSRF (CVE-2026-22219)

Target parameters: Database connection strings, webhook URLs, external API endpoints.

Test with Burp Collaborator:

1. Get Burp Collaborator URL: abc123.burpcollaborator.net
2. Inject into parameters: http://abc123.burpcollaborator.net/test
3. Check Collaborator for DNS/HTTP requests (confirms SSRF)

AWS IMDS exploitation:

# Step 1: Enumerate IAM roles
http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Step 2: Retrieve credentials for specific role
http://169.254.169.254/latest/meta-data/iam/security-credentials/[role-name]

# Response contains:
# - AccessKeyId
# - SecretAccessKey
# - Token (session token)
# - Expiration timestamp

Step 4: Use Snort/WAF Detection Rules

Security teams can deploy this Snort signature to detect ChainLeak exploitation attempts:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
  msg:"Chainleak Vulnerabilities Detection - PUT to /project/element";
  flow:established,to_server;
  content:"PUT"; http_method;
  content:"/project/element"; http_uri; depth:16;
  classtype:web-application-activity;
  sid:100001; rev:1;
)

How to Protect Your Organization

Immediate Actions

1. Patch immediately: Update Chainlit to version 2.9.4 or later
2. Audit infrastructure: Run pip list | grep chainlit on all servers to find vulnerable installations
3. Check logs: Search for suspicious requests to /project/element endpoint
4. Rotate credentials: If potentially compromised, rotate:
   • AWS access keys
   • Database passwords
   • CHAINLIT_AUTH_SECRET
   • API keys for LLM services

Long-Term Hardening

1. Enforce IMDSv2

Why: IMDSv2 requires a session token, blocking SSRF attacks on metadata service.

# AWS CLI: Enforce IMDSv2 on EC2 instances
aws ec2 modify-instance-metadata-options \
  --instance-id i-1234567890abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1

2. Implement Least Privilege IAM

Chainlit applications should run with minimal permissions:

• S3: Read-only access to specific buckets
• Secrets Manager: Retrieve only required secrets
• Bedrock/SageMaker: Invoke only, no model modification
• Deny: EC2 management, IAM changes, CloudFormation

3. Input Validation

If building custom AI applications:

• Whitelist allowed file paths (never accept user-supplied paths directly)
• Validate URLs before making external requests
• Use parameterized queries for database connections
• Sanitize user inputs in prompts (prevent injection)

4. Network Segmentation

• Place AI applications in isolated VPCs
• Use AWS PrivateLink for accessing AWS services (avoid public internet)
• Implement egress filtering (block access to metadata service IP: 169.254.169.254)

5. Web Application Firewall

Deploy WAF rules to block:

• Path traversal patterns: ../, ..%2f, %2e%2e/
• Requests to metadata service IPs
• Suspicious URL patterns in parameters

Detection & Monitoring

Set up alerts for:

• AWS CloudTrail: Unusual API calls from Chainlit IAM roles
• VPC Flow Logs: Connections to 169.254.169.254
• Application logs: Failed authentication attempts, 403/404 on sensitive paths
• Secrets Manager: AccessDenied errors (enumeration attempts)

Essential Tools for AI Application Security Testing

Frequently Asked Questions

Key Takeaways

1. AI frameworks are the new attack surface: 700,000 monthly downloads of Chainlit alone, with minimal security review
2. Cloud access = massive impact: Single vulnerability leads to complete AWS takeover in minutes
3. Patch immediately: Update Chainlit to 2.9.4+ and enforce IMDSv2 on all EC2 instances
4. Test systematically: Check all AI applications for file read and SSRF vulnerabilities
5. High bounty potential: AI framework security is an emerging field with significant payouts

The bigger picture: ChainLeak is a wake-up call. As organizations rush to deploy AI applications, security is an afterthought. Frameworks like Chainlit, Streamlit, and Gradio power thousands of enterprise AI deployments, many with direct cloud access and minimal hardening.

For bug bounty hunters: This is a goldmine. Every major AI framework is likely to have similar vulnerabilities. The combination of:

• Rapid development cycles
• Direct cloud access
• Sensitive data handling
• Large enterprise deployments

...creates perfect conditions for high-value vulnerabilities.

Next steps for hunters:

1. Audit other AI frameworks (Streamlit, Gradio, LangChain servers)
2. Test for similar file read and SSRF patterns
3. Check programs on HackerOne/Bugcrowd that mention AI/ML in scope
4. Document your methodology - write it up, get reputation, repeat

Remember: The researchers who found ChainLeak likely earned substantial recognition (and compensation if through a bug bounty program). You can find the next one. 🎯