CVE-2026-107292 · GHSA-q2xc-rrxj-58x9
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
- Risk score
- 44/100
- CVSS
- 6.4 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a s…
- Affected
- pydantic-ai (pip) >= 1.34.0, < 1.107.5; pydantic-ai (pip) >= 2.0.0b1, < 2.30.0; pydantic-ai-slim (pip) >= 1.34.0, < 1.107.5; pydantic-ai-slim (pip) >= 2.0.0b1, < 2.30.0
- Fix
- Upgrade pydantic-ai to 1.107.5 or 2.30.0; pydantic-ai-slim to 1.107.5 or 2.30.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
pydantic-ai: Amber, patch this week. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowin…
The flaws
- CVE-2026-107292: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (CVSS 6.4 · EPSS 0%)
- CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (CVSS 7.5 · EPSS 0%)
- CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (CVSS 7.6 · EPSS 0%)
- CVE-2026-107290: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (CVSS 6.5 · EPSS 0%)
The fix
Upgrade pydantic-ai: 1.107.5 · 2.30.0 · 2.53.0 · 1.107.4 · 2.28.0 · 1.107.6 or later on your release line
Who is exposed: pydantic-ai (pip) >= 2.10.0, < 2.53.0; pydantic-ai-slim (pip) >= 2.10.0, < 2.53.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-346 (CWE-346). 54 other warnings in 30 days
- Same product: Earlier pydantic-ai warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 6.4 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pydantic-ai | pip | >= 1.34.0, < 1.107.5 | 1.107.5 |
| pydantic-ai | pip | >= 2.0.0b1, < 2.30.0 | 2.30.0 |
| pydantic-ai-slim | pip | >= 1.34.0, < 1.107.5 | 1.107.5 |
| pydantic-ai-slim | pip | >= 2.0.0b1, < 2.30.0 | 2.30.0 |
References
- https://github.com/advisories/GHSA-q2xc-rrxj-58x9
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9
- https://github.com/pydantic/pydantic-ai/pull/7437
- https://github.com/pydantic/pydantic-ai/pull/7438
- https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe
- https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0
- https://github.com/advisories/GHSA-q2xc-rrxj-58x9
Original description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.