CVE-2026-46678
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Pydantic AI before version 1.99.0, when an application enables force_download='allow-local' for a URL, the cloud metadata blocklist can be bypassed by encoding the metadata IP in IPv6 form (e.g., IPv4-mapped IPv6), potentially exposing cloud IAM short-term credentials.
Risk Assessment
The risk is leakage of cloud IAM credentials (e.g., AWS, GCP) by an attacker controlling the download URL, potentially leading to unauthorized cloud resource access.
Recommendation
Update Pydantic AI to version 1.99.0 or later and avoid using force_download='allow-local' with untrusted URLs.
Other vulnerabilities in Pydantic AI
See all- CVE-2026-65975Medium
In Pydantic AI before versions 1.107.1 and 2.5.0, UI adapters (AG-UI and Vercel AI) incorrectly strip unresolved tool calls from message history. A client can cause a registered server tool to run with client-supplied arguments, bypassing the model and its guardrails.
- CVE-2026-54249Medium
In Pydantic AI before versions 1.106.0 and 2.0.0b6, the UI adapter (e.g., Vercel AI) does not validate UploadedFile references. A client can reference arbitrary files in the model provider or cloud storage account using server-side identity, potentially leading to unauthorized data access.
- CVE-2026-48782Medium
In versions 1.56.0 through 1.101.0 and 2.0.0b1 and 2.0.0b2 of the Pydantic AI framework, the cloud metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form, leading to the exposure of short-term IAM credentials in the cloud. The previous fix did not decode all IPv6 transition forms, resulting in a security vulnerability.
- CVE-2026-25580High
A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality from version 0.0.26 to before 1.56.0. Attackers can include malicious URLs in message history, causing the server to make HTTP requests to internal network resources.
- CVE-2026-25640High
In Pydantic AI versions 1.34.0 through 1.50.0, a path traversal vulnerability in the web UI allows an attacker to craft a malicious URL that fetches and executes arbitrary JavaScript from an external source on the same CDN instead of the legitimate chat UI package. This affects applications using Agent.to_web or clai web to serve a chat interface.
Original NVD description (English source)
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.