CVE-2026-107289 · GHSA-vmxc-h2x2-jmf3
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
- Risk score
- 56/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass th…
- Affected
- pydantic-ai (pip) >= 1.56.0, < 1.107.6; pydantic-ai (pip) >= 2.0.0b1, < 2.44.0; pydantic-ai-slim (pip) >= 1.56.0, < 1.107.6; pydantic-ai-slim (pip) >= 2.0.0b1, < 2.44.0
- Fix
- Upgrade pydantic-ai to 1.107.6 or 2.44.0; pydantic-ai-slim to 1.107.6 or 2.44.0 (whichever matches your release line) or later.
- Exploitation
- Public proof of concept
Story map
At a glance
pydantic-ai: Amber, patch this week. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowin…
The flaws
- CVE-2026-107289: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers (CVSS 6.8 · EPSS 0%)
- CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (CVSS 7.5 · EPSS 0%)
- CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (CVSS 7.6 · EPSS 0%)
- CVE-2026-107290: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (CVSS 6.5 · EPSS 0%)
The fix
Upgrade pydantic-ai: 1.107.6 · 2.44.0 · 2.53.0 · 1.107.4 · 2.28.0 or later on your release line
Who is exposed: pydantic-ai (pip) >= 2.10.0, < 2.53.0; pydantic-ai-slim (pip) >= 2.10.0, < 2.53.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Server-side request forgery (CWE-918). 223 other warnings in 30 days
- Same product: Earlier pydantic-ai warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 6.8 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pydantic-ai | pip | >= 1.56.0, < 1.107.6 | 1.107.6 |
| pydantic-ai | pip | >= 2.0.0b1, < 2.44.0 | 2.44.0 |
| pydantic-ai-slim | pip | >= 1.56.0, < 1.107.6 | 1.107.6 |
| pydantic-ai-slim | pip | >= 2.0.0b1, < 2.44.0 | 2.44.0 |
References
- https://github.com/advisories/GHSA-vmxc-h2x2-jmf3
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3
- https://github.com/pydantic/pydantic-ai/pull/8401
- https://github.com/pydantic/pydantic-ai/pull/8402
- https://github.com/pydantic/pydantic-ai/commit/02157e1b87bd45d3f2e111ce07afdf89f9fb0e5b
- https://github.com/pydantic/pydantic-ai/commit/4da70591460f51a8c4f128eaeef70a33340dbd55
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0
- https://github.com/advisories/GHSA-vmxc-h2x2-jmf3
Original description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.