Read the docs
TI-2026-36052 Aliases CVE-2026-48782GHSA-cg7w-rg45-pc59

Server-side request forgery in pydantic-ai

Priority LOW 30CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Partial pydantic-ai (pydantic): 1.102.0, 2.0.0b3pydantic-ai-slim (pydantic): 2.0.0b3, 1.102.0+2 more productsRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai1.56.0 to before 1.102.0; 2.0.0b1 to before 2.0.0b31.102.0, 2.0.0b3Patch availableCNA
pydanticpydantic-ai-slim2.0.0b1 to before 2.0.0b3; 1.56.0 to before 1.102.02.0.0b3, 1.102.0Patch availableCNA
—pydantic-ai-slim (PyPI)1.56.0 to before 1.102.01.102.0Patch availableGHSA-cg7w-rg45-pc59
—pydantic-ai (PyPI)1.56.0 to before 1.102.01.102.0Patch availableGHSA-cg7w-rg45-pc59
—pydantic-ai (PyPI)2.0.0b1 to before 2.0.0b32.0.0b3Patch availableGHSA-cg7w-rg45-pc59
—pydantic-ai-slim (PyPI)2.0.0b1 to before 2.0.0b32.0.0b3Patch availableGHSA-cg7w-rg45-pc59
  • pydantic-ai Vendorpydantic Affected 1.56.0 to before 1.102.0; 2.0.0b1 to before 2.0.0b3 Fixed in 1.102.0, 2.0.0b3 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 2.0.0b1 to before 2.0.0b3; 1.56.0 to before 1.102.0 Fixed in 2.0.0b3, 1.102.0 Patch available CNA
  • pydantic-ai-slim (PyPI) Vendor— Affected 1.56.0 to before 1.102.0 Fixed in 1.102.0 Patch available GHSA-cg7w-rg45-pc59
  • pydantic-ai (PyPI) Vendor— Affected 1.56.0 to before 1.102.0 Fixed in 1.102.0 Patch available GHSA-cg7w-rg45-pc59
  • pydantic-ai (PyPI) Vendor— Affected 2.0.0b1 to before 2.0.0b3 Fixed in 2.0.0b3 Patch available GHSA-cg7w-rg45-pc59
  • pydantic-ai-slim (PyPI) Vendor— Affected 2.0.0b1 to before 2.0.0b3 Fixed in 2.0.0b3 Patch available GHSA-cg7w-rg45-pc59

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*1.56.0 to before 1.102.0Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta1:*:*:*:python:*:*2.0.0 beta1Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta2:*:*:*:python:*:*2.0.0 beta2Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 1.56.0 to before 1.102.0 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta1:*:*:*:python:*:* Versions 2.0.0 beta1 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta2:*:*:*:python:*:* Versions 2.0.0 beta2 Vulnerable ·pydantic

Remediation

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.102.0, 2.0.0b3
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 2.0.0b3, 1.102.0
  • Fix · GHSA-cg7w-rg45-pc59 pydantic-ai-slim (PyPI) Fixed in 1.102.0 Advisory →
  • Fix · GHSA-cg7w-rg45-pc59 pydantic-ai (PyPI) Fixed in 1.102.0 Advisory →
  • Fix · GHSA-cg7w-rg45-pc59 pydantic-ai (PyPI) Fixed in 2.0.0b3 Advisory →
  • Fix · GHSA-cg7w-rg45-pc59 pydantic-ai-slim (PyPI) Fixed in 2.0.0b3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48782
  2. 2026-10-03 Alias added: GHSA-cg7w-rg45-pc59

References

Patch 2

Advisory 2

Other 2

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences