TI-2026-20687 Aliases CVE-2026-25580 GHSA-2jrp-274c-jhv3

Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

MEDIUM 44CWE-918Published 2026-02-06 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00649 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial pydantic-ai (pydantic): 1.56.0pydantic-ai (PyPI): 1.56.0+1 more productRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pydantic	pydantic-ai	0.0.26 to before 1.56.0	1.56.0	Patch available	CNA
—	pydantic-ai (PyPI)	0.0.26 to before 1.56.0	1.56.0	Patch available	GHSA-2jrp-274c-jhv3
—	pydantic-ai-slim (PyPI)	0.0.26 to before 1.56.0	1.56.0	Patch available	GHSA-2jrp-274c-jhv3

pydantic-ai Vendorpydantic Affected 0.0.26 to before 1.56.0 Fixed in 1.56.0 Patch available CNA
pydantic-ai (PyPI) Vendor— Affected 0.0.26 to before 1.56.0 Fixed in 1.56.0 Patch available GHSA-2jrp-274c-jhv3
pydantic-ai-slim (PyPI) Vendor— Affected 0.0.26 to before 1.56.0 Fixed in 1.56.0 Patch available GHSA-2jrp-274c-jhv3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pydantic:pydantic_ai::::::python::*	0.0.26 to before 1.56.0	Vulnerable	pydantic

cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 0.0.26 to before 1.56.0 Vulnerable ·pydantic

Remediation

Fix · CNA pydantic-ai (pydantic) Fixed in 1.56.0
Fix · GHSA-2jrp-274c-jhv3 pydantic-ai (PyPI) Fixed in 1.56.0 Advisory →
Fix · GHSA-2jrp-274c-jhv3 pydantic-ai-slim (PyPI) Fixed in 1.56.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2026-25580
2026-10-03 Alias added: GHSA-2jrp-274c-jhv3

References

TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
TI-2026-39151 Server-side request forgery in pydantic-ai CVSS 3.1MEDIUM 6.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences