Pydantic AI’s agent framework allows developers to opt a download URL into the force_download='allow-local' mode, disabling the default block on private or internal IP ranges. In versions 1.56.0 through 1.98.0, an attacker can encode the cloud‑metadata IP address into an IPv4‑mapped IPv6, 6to4, or NAT64 format, bypassing the blocklist and causing the application to retrieve short‑term IAM credentials from the metadata service. This bypass was part of an incomplete fix to a prior issue (CVE‑2026‑25580) and is a classic SSRF condition (CWE‑918), exposing sensitive authentication data to untrusted parties. The flaw is only exploitable when an application explicitly sets force_download='allow-local' for a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) derived from untrusted input; bundled integrations and developer‑controlled URLs do not propagate this setting, leaving them unaffected.

The affected products are pydantic:pydantic-ai and pydantic:pydantic-ai-slim. All releases from 1.56.0 up to and including 1.98.0 are vulnerable, and the issue was resolved in version 1.99.0. Users of developer‑controlled, trusted URLs are not at risk, and built‑in adapters that do not propagate force_download escape the vulnerability.

The CVSS score of 6.8 indicates moderate severity; however, the EPSS score of less than 1% suggests exploitation attempts are currently rare or difficult. The vulnerability is not on the CISA KEV list. Exploitation would require an application that explicitly sets force_download='allow-local' on a URL derived from untrusted input, so the attack vector is inferred from the description. Remediation mitigates the risk by preventing the bypass and protecting credential exposure.