EUVD-2026-50562
GHSA-h7p7-w5gc-xj3w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable adapter, no auth required per description; AC:H because valid cloud identifier needed; S:C and C:H reflect cross-account storage access via server credentials.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 2 pypi packages depend on pydantic-ai (2 direct, 0 indirect)
- 7 pypi packages depend on pydantic-ai-slim (5 direct, 2 indirect)
Ecosystem-wide dependent count for version 1.65.0 and other introduced versions.
DescriptionCVE.org
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references - which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) - were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.
AnalysisAI
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Technical ContextAI
Pydantic AI (CPE: cpe:2.3:a:pydantic:pydantic-ai and cpe:2.3:a:pydantic:pydantic-ai-slim) provides UI adapter integrations - such as the Vercel AI adapter - that accept serialized message histories from clients. These histories can include two distinct file reference types: URL-based references, which are scheme-validated, and UploadedFile references, which encode provider file IDs or cloud-storage URIs (e.g., s3://bucket/key, gs://bucket/object). Prior to the fix, UploadedFile references were passed through to the backend without any allowlist or ownership check. Because resolution occurs server-side using the application's own identity (IAM role, service account, or provider API key), this is a classic CWE-918 (Server-Side Request Forgery) pattern adapted to AI framework file handling: the client supplies the target identifier, but the server's privileged identity performs the actual retrieval, effectively laundering unauthorized access through the trusted application context.
RemediationAI
Upgrade pydantic-ai or pydantic-ai-slim to version 1.106.0 (v1 branch) or 2.0.0b6 (v2 beta branch) as the primary fix; both are confirmed by the vendor advisory at https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w. If an immediate upgrade is not feasible, restrict access to any endpoint that accepts client-submitted message history to authenticated and trusted clients only, reducing exposure for the PR:N unauthenticated attack path; note this is an application-layer control and does not fix the underlying validation bypass. Additionally, enforce cloud-storage bucket policies or IAM conditions that limit the server's identity to only the specific object paths it legitimately needs, reducing the blast radius of any successful SSRF exploitation. Avoid predictable or sequential object naming in cloud storage buckets accessible by the service account, as identifier guessability is a key enabling factor per AC:H.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today