Pydantic AI EUVD-2026-95077

Exploitation requires ALL of the following concrete preconditions, each confirmed by the vendor advisory: (1) the application must explicitly opt a URL into local network access via either a FileUrl (ImageUrl/AudioUrl/VideoUrl/DocumentUrl) with force_download='allow-local' or web_fetch_tool(allow_local_urls=True) - both OFF BY DEFAULT; (2) that URL must be influenceable by untrusted input (attacker-controlled, or model-chosen in the web_fetch_tool path); (3) the runtime must be an IPv6-enabled cloud environment with a reachable metadata service (e.g. AWS EC2/EKS with IPv6, GCP IPv6-only instances, Scaleway), since only the IPv6 metadata endpoints were reachable via zone-identifier smuggling. Limiting factors: applications using bundled ingestion integrations (e.g. Agent.to_web / clai web) are NOT affected via the FileUrl path because they do not propagate force_download from external data; IPv4, private-range, and transition-form metadata checks were never bypassable. The specific bypass is appending an IPv6 zone identifier (e.g. fd00:ec2::254%251) to a blocked metadata address.

This is a genuinely lower-priority issue despite its CWE-918 SSRF classification, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, 6.8 Medium) correctly captures the tension: although the attacker needs no privileges on the target (PR:N) and no user interaction (UI:N), the high attack complexity (AC:H) reflects a stack of required preconditions that the vendor advisory confirms - the application must explicitly opt an attacker-influenced URL into local network access (force_download='allow-local' or web_fetch_tool with allow_local_urls=True), both of which are DISABLED BY DEFAULT, and the environment must be IPv6-enabled (e.g. AWS EC2/EKS with IPv6, GCP IPv6-only, Scaleway). The scope change (S:C) and C:H are justified because success exposes cloud IAM short-term credentials from the metadata service, crossing a trust boundary. There is no EPSS score, KEV listing, or POC in the provided data - no public exploit identified at time of analysis - and this absence is consistent with a defense-in-depth hardening fix rather than an actively exploited flaw. Notably, this is explicitly an INCOMPLETE FIX of prior advisories (GHSA-cqp8-fcvh-x7r3/CVE-2026-46678 and GHSA-cg7w-rg45-pc59/CVE-2026-48782, themselves follow-ups to CVE-2026-25580), which raises the realistic likelihood that security-conscious operators who already allow local URLs are the exposed population. Net assessment: real but narrow; prioritize patching only where the opt-in local-access settings are actually enabled in an IPv6 environment.

An application has enabled local-URL access (force_download='allow-local' or web_fetch_tool(allow_local_urls=True)) and runs on an IPv6-enabled cloud instance. An attacker who can influence a fetched URL - or the LLM-chosen URL in the web_fetch_tool case - supplies a zone-scoped IPv6 metadata address such as http://[fd00:ec2::254%251]/latest/meta-data/iam/security-credentials/; the blocklist comparison fails because Python folds the zone id into IPv6Address equality, while the kernel ignores the zone for the non-link-local destination and reaches the metadata service, returning cloud IAM credentials. No public exploit was identified at time of analysis.