What is the CVSS score of CVE-2026-25580?

CVE-2026-25580 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-25580?

Pydantic AI versions 0.0.26 through 1.55.x contain a critical Server-Side Request Forgery vulnerability that could allow attackers to access internal systems and data through the framework's URL…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25580?

Yes, a public proof-of-concept exploit is available for CVE-2026-25580. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25580?

Within 24 hours: Identify all systems running Pydantic AI versions 0.0.26 to 1.55.x and assess whether they process untrusted URLs. Within 7 days: Apply the available patch to upgrade to version 1.56.0 or later across all affected systems, prioritizing production environments. Within 30 days: Conduct a security audit of systems that were running vulnerable versions to detect any unauthorized access or data exfiltration.

Python CVE-2026-25580

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-06 security-advisories@github.com

GHSA-2jrp-274c-jhv3

Python SSRF Pydantic Ai Pydantic

8.6

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Red Hat

8.6 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 20, 2026 - 21:01 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 21:01 nvd

Patch available

CVE Published

Feb 06, 2026 - 21:16 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on pydantic-ai-slim (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.0.26.

DescriptionCVE.org

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

AnalysisAI

Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Pydantic Ai. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affec