Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
Published: 2026-10-08
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential exposure of cloud IAM credentials via SSRF
Action: Apply Update
AI Analysis

Impact

The vulnerability allows an attacker to bypass Pydantic AI’s cloud‑metadata blocklist by appending an IPv6 zone identifier to an IPv6 address. This forces the software’s IPv6 address comparison to treat the zone identifier as part of the address, so the blocklist check fails even though the network stack discards the zone on a non‑link‑local destination and still reaches the metadata service. The result is that local network access may be granted to the metadata endpoint, potentially exposing sensitive IAM credentials. This flaw represents a Server‑Side Request Forgery (SSRF) weakness (CWE‑918) and an improper neutrality of return value (CWE‑1289).

Affected Systems

The issue affects the pydantic-ai and pydantic‑ai‑slim Python packages from version 1.56.0 through 1.107.5 and any release before 2.44.0. Versions 1.107.6 and 2.44.0 include a fix and are not vulnerable.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity. While EPSS data is missing, the vulnerability requires an IPv6‑enabled environment and the application must enable either FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True, both of which are disabled by default. Because of these prerequisites and the need for a zone identifier to modify the IPv6 address, exploitation is less likely but still possible. The vulnerability is not listed in the CISA KEV catalog, so there are no known widespread attacks, but the potential to expose cloud credentials warrants timely mitigation.

Generated by OpenCVE AI on October 8, 2026 at 18:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade pydantic‑ai to version 1.107.6 or later, or to 2.44.0 or later, ensuring the fix is applied.
  • Disable the use of force_download='allow-local' and allow_local_urls=True unless absolutely required, or otherwise enforce strict URL validation before passing to these methods.
  • Implement network controls that restrict access to cloud‑metadata endpoints, such as firewall or ACL rules to block traffic to the metadata service.

Generated by OpenCVE AI on October 8, 2026 at 18:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vmxc-h2x2-jmf3 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
History

Tue, 13 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Pydantic pydantic Ai
CPEs cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*
cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*
Vendors & Products Pydantic pydantic Ai

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 08 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Pydantic
Pydantic pydantic-ai
Vendors & Products Pydantic
Pydantic pydantic-ai

Thu, 08 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
Title Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)
Weaknesses CWE-1289
CWE-918
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Pydantic Pydantic-ai Pydantic Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-08T16:07:40.109Z

Reserved: 2026-10-07T15:53:23.586Z

Link: CVE-2026-107289

cve-icon Vulnrichment

Updated: 2026-10-08T16:07:33.864Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T16:17:04.337

Modified: 2026-10-13T14:34:48.123

Link: CVE-2026-107289

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-08T15:20:18Z

Links: CVE-2026-107289 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T18:45:17Z

Weaknesses
  • CWE-1289

    Improper Validation of Unsafe Equivalence in Input

  • CWE-918

    Server-Side Request Forgery (SSRF)