Is CVE-2026-107289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107289 being exploited in the wild.

How severe is CVE-2026-107289?

Medium severity, with a CVSS score of 6.8, published 8 October 2026.

Which products and versions are affected?

pydantic-ai (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0.

How is CVE-2026-107289 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107289?

Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107289: Pydantic AI SSRF in cloud-metadata blocklist bypass via IPv6 zone identifiers

CVE-2026-107289 · Severity: medium · CVSS 6.8 · Published 2026-10-08

Pydantic AI is a framework for building AI applications. When configured to allow local network access for file downloads or web fetching, an attacker can exploit IPv6 zone identifiers to bypass the cloud-metadata blocklist and access cloud provider credentials. This requires the application to allow local URLs with untrusted input, exposing sensitive IAM credentials.

Technologies: Pydantic AI, pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: Pydantic, PyPI.

Quick answers

Is CVE-2026-107289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107289 being exploited in the wild.
How severe is CVE-2026-107289?: Medium severity, with a CVSS score of 6.8, published 8 October 2026.
Which products and versions are affected?: pydantic-ai (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0.
Is there a fix for CVE-2026-107289?: Yes. pydantic-ai (PyPI): upgrade to 2.44.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.44.0 or later. Until then: Reject URL hosts containing the percent character (`%`) before constructing FileUrl or configuring web_fetch_tool if the URL could be influenced by untrusted input, or avoid opting into local network access entirely for untrusted URLs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107289 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107289?: Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pydantic-ai (PyPI): upgrade to 2.44.0 or later
```
pip install "pydantic-ai>=2.44.0"
```
pydantic-ai-slim (PyPI): upgrade to 2.44.0 or later
```
pip install "pydantic-ai-slim>=2.44.0"
```

Reject URL hosts containing the percent character (`%`) before constructing FileUrl or configuring web_fetch_tool if the URL could be influenced by untrusted input, or avoid opting into local network access entirely for untrusted URLs.

Technical details

The vulnerability exploits incomplete IPv6 zone identifier handling in the cloud-metadata blocklist checks. Python's IPv6Address class treats zone identifiers as part of the address for equality and hashing, so a blocked address like `fd00:ec2::254%251` does not match the blocklist entry for `fd00:ec2::254`. The network stack ignores zone identifiers for non-link-local destinations, allowing the request to reach the metadata endpoint. The issue affects only IPv6-enabled cloud environments and requires the application to enable `force_download='allow-local'` or `web_fetch_tool(allow_local_urls=True)` with untrusted input.

Affected products

Pydantic Pydantic AI

Identifiers

CVE-2026-107289
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
PYSEC-2026-4291

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.