Executive brief
Pydantic AI is a framework used to build artificial intelligence applications. A security flaw exists where the system's protections against accessing sensitive internal data can be bypassed if a developer specifically enables local file downloads for user-provided links. If exploited, an attacker could steal temporary security credentials from the cloud environment where the application is running, potentially leading to unauthorized access to other cloud resources.
Technical details
This vulnerability is a Server-Side Request Forgery (SSRF) bypass resulting from an incomplete fix for a previous issue. When an application explicitly sets 'force_download=allow-local' on a FileUrl influenced by untrusted input, the framework's blocklist for cloud metadata endpoints can be bypassed. Attackers can use IPv6 transition forms (such as IPv4-mapped IPv6, 6to4, or NAT64) to represent blocked IPv4 metadata addresses. On dual-stack or translated networks, these requests are routed to the underlying IPv4 metadata service, allowing the retrieval of IAM short-term credentials. The issue is fixed in version 1.99.0 by normalizing IPv6 transition forms during URL validation.
Affected products
- pydantic pydantic-ai >= 1.56.0, < 1.99.0
- pydantic pydantic-ai-slim >= 1.56.0, < 1.99.0
Timeline
- 2026-05-19: patched: Version 1.99.0 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE-2026-46678 published to NVD