# CVE-2026-46678: Pydantic Pydantic AI SSRF bypass in cloud-metadata blocklist

Source: https://junglewise.ai/threats/cve-2026-46678-pydantic-pydantic-ai-ssrf-bypass-in-cloud-metadata-blocklist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-46678 · Severity: medium · CVSS 6.8 · Published 2026-07-29

Pydantic AI is a framework used to build artificial intelligence applications. A security flaw exists where the system's protections against accessing sensitive internal data can be bypassed if a developer specifically enables local file downloads for user-provided links. If exploited, an attacker could steal temporary security credentials from the cloud environment where the application is running, potentially leading to unauthorized access to other cloud resources.

Technologies: [Pydantic AI Slim](https://junglewise.ai/threats/technologies/ai-slim), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-46678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46678 being exploited in the wild.

**How severe is CVE-2026-46678?** Medium severity, with a CVSS score of 6.8, published 29 July 2026.

**Which products and versions are affected?** pydantic-ai (PyPI) >= 1.56.0, < 1.99.0, ECOSYSTEM:introduced=1.56.0,fixed=1.99.0; pydantic-ai-slim (PyPI) >= 1.56.0, < 1.99.0, ECOSYSTEM:introduced=1.56.0,fixed=1.99.0.

**Is there a fix for CVE-2026-46678?** Yes. pydantic-ai (PyPI): upgrade to 1.99.0 or later; pydantic-ai-slim (PyPI): upgrade to 1.99.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46678 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46678?** Check whether you run Pydantic AI Slim, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 1.99.0 or later

  ```sh
  pip install "pydantic-ai>=1.99.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 1.99.0 or later

  ```sh
  pip install "pydantic-ai-slim>=1.99.0"
  ```


## Technical details

This vulnerability is a Server-Side Request Forgery (SSRF) bypass resulting from an incomplete fix for a previous issue. When an application explicitly sets 'force_download=allow-local' on a FileUrl influenced by untrusted input, the framework's blocklist for cloud metadata endpoints can be bypassed. Attackers can use IPv6 transition forms (such as IPv4-mapped IPv6, 6to4, or NAT64) to represent blocked IPv4 metadata addresses. On dual-stack or translated networks, these requests are routed to the underlying IPv4 metadata service, allowing the retrieval of IAM short-term credentials. The issue is fixed in version 1.99.0 by normalizing IPv6 transition forms during URL validation.

## Affected products

- pydantic pydantic-ai >= 1.56.0, < 1.99.0
- pydantic pydantic-ai-slim >= 1.56.0, < 1.99.0

## Identifiers

- CVE-2026-46678
- GHSA-cqp8-fcvh-x7r3
- PYSEC-2026-2978
- PYSEC-2026-2982

## Timeline

- 2026-05-19: patched: Version 1.99.0 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE-2026-46678 published to NVD

## References

- [https://github.com/pydantic/pydantic-ai/releases/tag/v1.99.0](https://github.com/pydantic/pydantic-ai/releases/tag/v1.99.0)
- [https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3)

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)