CVE-2026-25580
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality from version 0.0.26 to before 1.56.0. Attackers can include malicious URLs in message history, causing the server to make HTTP requests to internal network resources.
Risk Assessment
The risk involves potential access to internal services or cloud credentials, which could lead to data breaches or further compromise of the infrastructure.
Recommendation
Immediately update Pydantic AI to version 1.56.0 or later, which contains the fix for the SSRF vulnerability.
Other vulnerabilities in Pydantic AI
See all- CVE-2026-65975Medium
In Pydantic AI before versions 1.107.1 and 2.5.0, UI adapters (AG-UI and Vercel AI) incorrectly strip unresolved tool calls from message history. A client can cause a registered server tool to run with client-supplied arguments, bypassing the model and its guardrails.
- CVE-2026-54249Medium
In Pydantic AI before versions 1.106.0 and 2.0.0b6, the UI adapter (e.g., Vercel AI) does not validate UploadedFile references. A client can reference arbitrary files in the model provider or cloud storage account using server-side identity, potentially leading to unauthorized data access.
- CVE-2026-46678Medium
In Pydantic AI before version 1.99.0, when an application enables force_download='allow-local' for a URL, the cloud metadata blocklist can be bypassed by encoding the metadata IP in IPv6 form (e.g., IPv4-mapped IPv6), potentially exposing cloud IAM short-term credentials.
- CVE-2026-48782Medium
In versions 1.56.0 through 1.101.0 and 2.0.0b1 and 2.0.0b2 of the Pydantic AI framework, the cloud metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form, leading to the exposure of short-term IAM credentials in the cloud. The previous fix did not decode all IPv6 transition forms, resulting in a security vulnerability.
- CVE-2026-25640High
In Pydantic AI versions 1.34.0 through 1.50.0, a path traversal vulnerability in the web UI allows an attacker to craft a malicious URL that fetches and executes arbitrary JavaScript from an external source on the same CDN instead of the legitimate chat UI package. This affects applications using Agent.to_web or clai web to serve a chat interface.
Original NVD description (English source)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.