EUVD-2026-37512
GHSA-cg7w-rg45-pc59
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
AV:N because exploit is delivered via HTTP fetch; AC:H because NAT64/ISATAP network routing is a genuine environmental prerequisite; S:C for trust-boundary crossing to metadata plane; C:H for IAM credential exposure; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 pypi packages depend on pydantic-ai (2 direct, 0 indirect)
- 12 pypi packages depend on pydantic-ai-slim (10 direct, 2 indirect)
Ecosystem-wide dependent count for version 1.56.0 and other introduced versions.
DescriptionCVE.org
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3.
AnalysisAI
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default force_download='allow-local' mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Technical ContextAI
Pydantic AI's SSRF guard in pydantic_ai/_ssrf.py normalizes IPv6 addresses to their embedded IPv4 form before comparing against a private/metadata IP blocklist. The incomplete fix in CVE-2026-46678 decoded IPv4-mapped IPv6 (::ffff:a.b.c.d), 6to4 (2002::/16), and the RFC 6052 NAT64 well-known prefix (64:ff9b::/96), but did not handle: IPv4-compatible IPv6 (::a.b.c.d, RFC 4291), the RFC 8215 NAT64 local-use prefix (64:ff9b:1::/48) with sub-prefixes at /48, /56, /64, or /96, operator-chosen NAT64 prefixes, and ISATAP tunnel addresses (RFC 5214, interface ID pattern ::0:5efe:a.b.c.d). The CWE-918 root cause is the blocklist operating on the IPv6 wrapper rather than the embedded IPv4 destination, allowing an attacker-supplied IPv6 literal to smuggle a blocked IPv4 address past the guard. The fix in v1.102.0/2.0.0b3 (PR #5596, commit 1add06179b) introduces _embedded_ipv4s(), which decodes all standardized IPv6 embedding offsets defined in RFC 6052 §2.2 and handles ISATAP and Teredo separately; it also expands the cloud metadata blocklist to cover AWS ECS/EKS credential endpoints, Azure WireServer (168.63.129.16, a public IP that was previously not caught by private-range checks), GCP IPv6, Scaleway, and Oracle Cloud Classic. CPE strings are cpe:2.3:a:pydantic:pydantic-ai and cpe:2.3:a:pydantic:pydantic-ai-slim.
RemediationAI
Vendor-released patch: v1.102.0 (stable series) and 2.0.0b3 (pre-release series). Upgrade pydantic-ai or pydantic-ai-slim to v1.102.0 or 2.0.0b3, available at https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0 (commit 1add06179ba4de259f7ab977620b697b7209f7e4, PR https://github.com/pydantic/pydantic-ai/pull/5596). If an immediate upgrade is not feasible, the most effective compensating control is to remove all uses of force_download='allow-local' from application code; this re-enables the default private/internal IP blocklist and eliminates the prerequisite for exploitation, at the cost of disabling the intentional local-URL access the setting provides. As a network-layer alternative on NAT64 environments, configure egress ACLs at the NAT64 gateway to block translation of 169.254.0.0/16 and the other metadata ranges (169.254.170.2, 169.254.170.23, 168.63.129.16, 100.100.100.200) to their IPv6 equivalents; this is operationally complex and requires knowledge of all operator NAT64 prefixes in use. Applications that do not use force_download='allow-local' require no immediate action.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today