Skip to main content

Pydantic Ai CVE-2026-25580

HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-02-06 security-advisories@github.com GHSA-2jrp-274c-jhv3
Python SSRF Pydantic Ai Pydantic
8.6
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send malicious URL in message history
  2. Exploit
    Server processes URL download function
  3. Execution
    HTTP request to internal resource
  4. Impact
    Exfiltrate internal service data or credentials

Vulnerability Assessment

Weakness
CWE
CWE-918
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Credential Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Application must accept message history from untrusted external users and process URL downloads via Pydantic AI versions 0.0.26 to 1.55.x without URL validation.
Impact

CVSS 8.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived

A remote attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 8.6

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. [CVSS 8.6 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.56.0.. Restrict network access to the affected service where possible.

Affected Packages

pypi pydantic-ai fix: 1.56.0
pypi pydantic-ai-slim fix: 1.56.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Pydantic Ai. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affec

Know when Pydantic Ai gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Red Hat 8.6 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
PoC Detected
Feb 20, 2026 - 21:01 vuln.today
Public exploit code
Patch released
Feb 20, 2026 - 21:01 nvd
Patch available
CVE Published
Feb 06, 2026 - 21:16 nvd
HIGH 8.6

DescriptionCVE.org

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

Executive ViewAI

Why It Matters

Pydantic AI versions 0.0.26 through 1.55.x contain a critical Server-Side Request Forgery vulnerability that could allow attackers to access internal systems and data through the framework's URL download functionality. Organizations using affected versions of this Python AI framework in production environments face immediate risk of data breach and unauthorized access to internal resources.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not possible: (1) Disable or restrict URL download functionality in Pydantic AI configurations; (2) Implement network segmentation to prevent agents from accessing internal systems; (3) Deploy Web Application Firewall rules to block suspicious URL patterns and internal IP ranges in requests; (4) Monitor outbound connections from systems running Pydantic AI for anomalous activity.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

63
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

Affected Products (CPE)CVE.org

cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*

More in Pydantic Ai

View all
CVE-2026-107295 HIGH
7.6 Oct 08

Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit whil
CVE-2026-107286 HIGH
7.5 Oct 08

Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots i
CVE-2026-48782 MEDIUM
6.8 Jun 16

Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
CVE-2026-107289 MEDIUM
6.8 Oct 08

Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL int
CVE-2026-54249 MEDIUM POC
6.8 Jul 29

Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
CVE-2026-107294 MEDIUM
6.5 Oct 08

Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying
CVE-2026-107290 MEDIUM
6.5 Oct 08

Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through

CVE-2026-107287 MEDIUM
6.5 Oct 08

Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML p
CVE-2026-65975 MEDIUM
6.5 Jul 29

Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
CVE-2026-107292 MEDIUM
6.4 Oct 08

DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website
CVE-2026-25640 MEDIUM
5.4 Feb 06

Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthentica
CVE-2026-107288 LOW
3.7 Oct 08

A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5

Vendor StatusVendor

References

Advisories & patches
PATCH https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301 ADVISORY https://vuldb.com/vuln/344781 REF https://access.redhat.com/security/cve/CVE-2026-25580 REF https://bugzilla.redhat.com/show_bug.cgi?id=2437781 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25580.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy