Pydantic AI CVE-2026-54249

Exploitation requires that the application exposes a Pydantic AI UI adapter endpoint (such as the Vercel AI adapter) that accepts client-submitted message history containing UploadedFile objects. The attacker must supply a valid provider file ID or cloud-storage URI (e.g., s3://bucket/key or gs://bucket/object) that the server's backend identity (IAM role, service account, or API key) is authorized to resolve - identifiers that are randomly generated and unguessable significantly raise the effective attack complexity consistent with AC:H. Exploitation is limited by: (1) the attacker's ability to reach the adapter endpoint (applications placing this behind authentication reduce PR:N exposure); (2) the guessability or prior leakage of valid file identifiers; (3) IAM policies constraining which storage objects the server identity can access. There is no required special platform, OS, or non-default configuration beyond the use of a UI adapter that processes message history - any deployment of the affected versions using the Vercel AI adapter or equivalent is in scope.

The CVSS 6.8 rating with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N accurately reflects the threat model. AC:H is the dominant risk-reducing factor: successful exploitation requires the attacker to supply a valid file identifier or cloud-storage URI that the server's identity can resolve - identifiers are not always unguessable depending on how the application names objects (e.g., sequential IDs, predictable prefixes, or leaked identifiers from prior interactions). S:C with C:H indicates a scope change: the attacker's reach extends beyond the Pydantic AI application itself into the server's cloud-storage account or potentially other tenants, making the confidentiality impact high when a valid identifier is obtained. No EPSS score was provided in source data. The vulnerability is not listed in the CISA KEV catalog and no POC is known, so real-world exploitation risk is currently speculative but the impact when conditions are met is significant for applications with predictable storage naming or multi-tenant architectures. CVSS PR:N suggests the adapter endpoint is accessible without application-level authentication, though this is not confirmed by description text alone - deployments that require authentication before reaching the adapter reduce exposure materially.

An attacker who can submit message history to a Pydantic AI Vercel AI adapter endpoint - whether because the endpoint is publicly exposed or the attacker holds a valid application session - crafts a message containing an UploadedFile reference pointing to an S3 URI such as s3://app-internal-bucket/secrets/env.json. The server, acting under its own IAM role, fetches the object and returns the content to the attacker, bypassing any bucket-level restrictions that would otherwise block the client's direct access. No public exploit code has been identified at time of analysis, but the attack pattern requires only knowledge of a valid cloud-storage URI reachable by the server's identity.