CVE-2026-48782
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In versions 1.56.0 through 1.101.0 and 2.0.0b1 and 2.0.0b2 of the Pydantic AI framework, the cloud metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form, leading to the exposure of short-term IAM credentials in the cloud. The previous fix did not decode all IPv6 transition forms, resulting in a security vulnerability.
Risk Assessment
Organizations using vulnerable versions of Pydantic AI may be exposed to unauthorized access to their IAM credentials, potentially leading to serious security incidents and data loss.
Recommendation
It is recommended to upgrade to version 2.0.0b3, which fixes this vulnerability. Additionally, consider limiting the use of the force_download='allow-local' option in applications using Pydantic AI.
Other vulnerabilities in Pydantic AI
See all- CVE-2026-65975Medium
In Pydantic AI before versions 1.107.1 and 2.5.0, UI adapters (AG-UI and Vercel AI) incorrectly strip unresolved tool calls from message history. A client can cause a registered server tool to run with client-supplied arguments, bypassing the model and its guardrails.
- CVE-2026-54249Medium
In Pydantic AI before versions 1.106.0 and 2.0.0b6, the UI adapter (e.g., Vercel AI) does not validate UploadedFile references. A client can reference arbitrary files in the model provider or cloud storage account using server-side identity, potentially leading to unauthorized data access.
- CVE-2026-46678Medium
In Pydantic AI before version 1.99.0, when an application enables force_download='allow-local' for a URL, the cloud metadata blocklist can be bypassed by encoding the metadata IP in IPv6 form (e.g., IPv4-mapped IPv6), potentially exposing cloud IAM short-term credentials.
- CVE-2026-25580High
A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality from version 0.0.26 to before 1.56.0. Attackers can include malicious URLs in message history, causing the server to make HTTP requests to internal network resources.
- CVE-2026-25640High
In Pydantic AI versions 1.34.0 through 1.50.0, a path traversal vulnerability in the web UI allows an attacker to craft a malicious URL that fetches and executes arbitrary JavaScript from an external source on the same CDN instead of the legitimate chat UI package. This affects applications using Agent.to_web or clai web to serve a chat interface.
Original NVD description (English source)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3.