# CVE-2026-107289: Pydantic AI SSRF in cloud-metadata blocklist bypass via IPv6 zone identifiers

Source: https://junglewise.ai/threats/cve-2026-107289-pydantic-ai-ssrf-cloud-metadata-blocklist-bypass-via-ipv6-zone  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107289 · Severity: medium · CVSS 6.8 · Published 2026-10-08

Pydantic AI is a framework for building AI applications. When configured to allow local network access for file downloads or web fetching, an attacker can exploit IPv6 zone identifiers to bypass the cloud-metadata blocklist and access cloud provider credentials. This requires the application to allow local URLs with untrusted input, exposing sensitive IAM credentials.

Technologies: [Pydantic AI](https://junglewise.ai/threats/technologies/pydantic-pydantic-ai), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107289 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107289 being exploited in the wild.

**How severe is CVE-2026-107289?** Medium severity, with a CVSS score of 6.8, published 8 October 2026.

**Which products and versions are affected?** pydantic-ai (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.107.6,introduced=2.0.0b1,fixed=2.44.0.

**Is there a fix for CVE-2026-107289?** Yes. pydantic-ai (PyPI): upgrade to 2.44.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.44.0 or later. Until then: Reject URL hosts containing the percent character (`%`) before constructing FileUrl or configuring web_fetch_tool if the URL could be influenced by untrusted input, or avoid opting into local network access entirely for untrusted URLs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107289 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107289?** Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 2.44.0 or later

  ```sh
  pip install "pydantic-ai>=2.44.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 2.44.0 or later

  ```sh
  pip install "pydantic-ai-slim>=2.44.0"
  ```


Reject URL hosts containing the percent character (`%`) before constructing FileUrl or configuring web_fetch_tool if the URL could be influenced by untrusted input, or avoid opting into local network access entirely for untrusted URLs.

## Technical details

The vulnerability exploits incomplete IPv6 zone identifier handling in the cloud-metadata blocklist checks. Python's IPv6Address class treats zone identifiers as part of the address for equality and hashing, so a blocked address like `fd00:ec2::254%251` does not match the blocklist entry for `fd00:ec2::254`. The network stack ignores zone identifiers for non-link-local destinations, allowing the request to reach the metadata endpoint. The issue affects only IPv6-enabled cloud environments and requires the application to enable `force_download='allow-local'` or `web_fetch_tool(allow_local_urls=True)` with untrusted input.

## Affected products

- Pydantic Pydantic AI

## Identifiers

- CVE-2026-107289
- GHSA-vmxc-h2x2-jmf3
- PYSEC-2026-4282
- PYSEC-2026-4291

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)