Read the docs
TI-2026-34309 Aliases CVE-2026-46678GHSA-cqp8-fcvh-x7r3

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Priority LOW 30CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed pydantic-ai (pydantic): 1.99.0pydantic-ai-slim (pydantic): 1.99.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai1.56.0 to before 1.99.01.99.0Patch availableCNA
pydanticpydantic-ai-slim1.56.0 to before 1.99.01.99.0Patch availableCNA
—pydantic-ai (PyPI)1.56.0 to before 1.99.01.99.0Patch availableGHSA-cqp8-fcvh-x7r3
—pydantic-ai-slim (PyPI)1.56.0 to before 1.99.01.99.0Patch availableGHSA-cqp8-fcvh-x7r3
  • pydantic-ai Vendorpydantic Affected 1.56.0 to before 1.99.0 Fixed in 1.99.0 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 1.56.0 to before 1.99.0 Fixed in 1.99.0 Patch available CNA
  • pydantic-ai (PyPI) Vendor— Affected 1.56.0 to before 1.99.0 Fixed in 1.99.0 Patch available GHSA-cqp8-fcvh-x7r3
  • pydantic-ai-slim (PyPI) Vendor— Affected 1.56.0 to before 1.99.0 Fixed in 1.99.0 Patch available GHSA-cqp8-fcvh-x7r3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*1.56.0 to before 1.99.0Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 1.56.0 to before 1.99.0 Vulnerable ·pydantic

Remediation

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.99.0
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 1.99.0
  • Fix · GHSA-cqp8-fcvh-x7r3 pydantic-ai (PyPI) Fixed in 1.99.0 Advisory →
  • Fix · GHSA-cqp8-fcvh-x7r3 pydantic-ai-slim (PyPI) Fixed in 1.99.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Lightspeed Core
  • Red Hat Enterprise Linux AI (RHEL AI) 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46678
  2. 2026-10-03 Alias added: GHSA-cqp8-fcvh-x7r3

References

Advisory 1

Other 3

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences