CVE-2026-25580: Pydantic Pydantic AI SSRF in URL download functionality

CVE-2026-25580 · Severity: high · CVSS 8.6 · Published 2026-02-06

Pydantic AI is a framework used to build applications powered by Generative AI. A security flaw in how the framework handles web links (URLs) allows attackers to trick the server into making unauthorized requests to internal systems. This could lead to the exposure of sensitive internal data, such as cloud service credentials or private network information, if the application accepts chat history or file attachments from external users.

Technologies: PydanticAI, pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: Pydantic, PyPI.

Quick answers

Is CVE-2026-25580 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25580 being exploited in the wild.
How severe is CVE-2026-25580?
High severity, with a CVSS score of 8.6, published 6 February 2026.
Which products and versions are affected?
PydanticAI >= 0.0.26, < 1.56.0; PydanticAI Slim >= 0.0.26, < 1.56.0; pydantic-ai (PyPI) ECOSYSTEM:introduced=0.0.26,fixed=1.56.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=0.0.26,fixed=1.56.0.
Is there a fix for CVE-2026-25580?
Yes. pydantic-ai (PyPI): upgrade to 1.56.0 or later; pydantic-ai-slim (PyPI): upgrade to 1.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25580 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25580?
Check whether you run PydanticAI, PydanticAI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pydantic-ai (PyPI): upgrade to 1.56.0 or later
    pip install "pydantic-ai>=1.56.0"
  • pydantic-ai-slim (PyPI): upgrade to 1.56.0 or later
    pip install "pydantic-ai-slim>=1.56.0"

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `download_item()` helper function within Pydantic AI. The component fails to validate that user-supplied URLs in message history (such as ImageUrl, AudioUrl, or VideoUrl objects) point to public internet addresses. An unauthenticated remote attacker can provide URLs targeting internal IP ranges (e.g., 127.0.0.1, 10.x.x.x) or cloud metadata services (e.g., 169.254.169.254) to exfiltrate sensitive credentials or scan internal networks. The fix, introduced in version 1.56.0, implements a new `_ssrf.py` module that enforces protocol validation, performs DNS resolution before requests to prevent rebinding, and blocks private/link-local IP ranges by default.

Affected products

  • pydantic pydantic-ai >= 0.0.26, < 1.56.0
  • pydantic pydantic-ai-slim >= 0.0.26, < 1.56.0
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 3

Identifiers

  • CVE-2026-25580
  • GHSA-2jrp-274c-jhv3
  • PYSEC-2026-2976
  • PYSEC-2026-2980

Timeline

  • 2026-02-05: patched: Fix committed to repository
  • 2026-02-06: advisory: GitHub Security Advisory published
  • 2026-02-06: disclosed: CVE-2026-25580 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.