Read the docs
TI-2026-69634 Aliases CVE-2026-107288

Blocked domain bypass in Pydantic AI web_fetch_tool

Priority LOW 18CWE-1289Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Pydantic AI, a Python agent framework for Generative AI applications, is affected in pydantic-ai and pydantic-ai-slim from 1.77.0 before 1.107.6 and from 2.0.0b1 before 2.44.0. The local web_fetch_tool compares blocked_domains entries with the URL hostname before normalizing both, so an equivalent hostname spelling can bypass the block (CWE-918). An attacker who influences the model can make the application fetch a blocked host with its own privileges, though allowed_domains fails closed and private-IP and cloud-metadata protections remain effective.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Partial pydantic-ai (pydantic): 1.107.6, 2.44.0pydantic-ai-slim (pydantic): 1.107.6, 2.44.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai1.77.0 to before 1.107.6; 2.0.0b1 to before 2.44.01.107.6, 2.44.0Patch availableCNA
pydanticpydantic-ai-slim1.77.0 to before 1.107.6; 2.0.0b1 to before 2.44.01.107.6, 2.44.0Patch availableCNA
  • pydantic-ai Vendorpydantic Affected 1.77.0 to before 1.107.6; 2.0.0b1 to before 2.44.0 Fixed in 1.107.6, 2.44.0 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 1.77.0 to before 1.107.6; 2.0.0b1 to before 2.44.0 Fixed in 1.107.6, 2.44.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*1.77.0 to before 1.107.6Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*2.0.0 to before 2.44.0Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 1.77.0 to before 1.107.6 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:* Versions 2.0.0 to before 2.44.0 Vulnerable ·pydantic

Remediation

Upgrade pydantic-ai and pydantic-ai-slim to version 1.107.6 or 2.44.0. Red Hat lists Lightspeed Core and Red Hat Enterprise Linux AI (RHEL AI) 3 as affected with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.107.6, 2.44.0
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 1.107.6, 2.44.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107288
  2. 2026-10-09 Affected versions changed · Red Hat
  3. 2026-10-09 CVSS score added · Red Hat

References

Patch 8

Advisory 1

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences