Pydantic AI CVE-2026-48782

Two simultaneous conditions are required. First, the application must explicitly pass force_download='allow-local' to the Pydantic AI URL-fetch interface - this is a non-default opt-in setting that intentionally disables the private/internal IP blocklist; applications that do not set this flag are fully protected by the default behavior and are unaffected. Second, the deployment network must actually route one of the affected IPv6 transition forms to the target IPv4 metadata address: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64, including some Kubernetes deployments) for NAT64 variants (RFC 8215 64:ff9b:1::/48 sub-prefixes and operator NAT64 prefixes), or a network with an active ISATAP tunnel for the ISATAP variant. The advisory explicitly confirms that a standard dual-stack cloud VM or container does not route these forms and is not affected in practice. IPv4-compatible (::a.b.c.d) and Teredo variants are deprecated mechanisms addressed as defense-in-depth; their real-world network routing is negligible. CVSS PR:N confirms no authentication is required once the above conditions are met.

The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N (6.8 Medium) accurately reflects the real-world risk profile. AV:N is correct - the exploit path is an HTTP fetch originating from a network-accessible application. AC:H is well-justified: NAT64 or ISATAP routing is a genuine environmental prerequisite absent in the majority of standard dual-stack cloud deployments; the advisory explicitly states that a standard dual-stack cloud VM or container is not affected. PR:N reflects that no authentication is required once the application has already been configured with force_download='allow-local'. S:C captures the trust-boundary crossing from the application into the cloud provider's metadata plane. C:H reflects exposure of short-term IAM credentials, which can enable lateral movement or privilege escalation within the cloud account. No EPSS score was provided in the input and cannot be inferred. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified - however, the iterative bypass pattern (three CVEs in the same protection mechanism) suggests active adversarial interest. Real-world priority should be elevated for organizations deploying Pydantic AI with force_download='allow-local' on Kubernetes clusters using NAT64, and lower for all other deployments.

An attacker who can influence a URL processed by a Pydantic AI application configured with force_download='allow-local' on a NAT64-enabled Kubernetes cluster crafts a request URL containing 169.254.169.254 encoded as a 64:ff9b:1::-prefixed NAT64 address (e.g., 64:ff9b:1::a9fe:a9fe), which the prior-version blocklist passes unchecked because it only decoded the RFC 6052 well-known NAT64 prefix. The cluster's NAT64 gateway translates the IPv6 address back to 169.254.169.254, the application retrieves the AWS IMDS response, and the attacker obtains short-term IAM credentials attached to the pod's instance role. No public exploit code has been identified at time of analysis.